Mark Ryan

Joshua Guttman

Cas Cremers

Vicent Cheval

Hubert Comon

Loredana

Sergiu, Oana, Corina Yuki Daniel

This thesis is about the formal verification and composition of security protocols, motivated by applications to electronic voting protocols. Chapters 3 to 5 concern the verification of security protocols while Chapter 6 concerns composition.

We show in Chapter 3 how to reduce certain problems from a quotient term algebra to the free term algebra via the use of strongly complete sets of variants. We show that, when the quotient algebra is given by a convergent optimally reducing rewrite system, finite strongly complete sets of variants exist and are effectively computable.

In Chapter 4, we show that static equivalence for (classes of) equational theories including subterm convergent equational theories, trapdoor commitment and blind signatures is decidable in polynomial time. We also provide an efficient implementation.

In Chapter 5 we extend the previous decision procedure to handle trace equivalence. We use finite strongly complete sets of variants introduced in Chapter 3 to get rid of the equational theory and we model each protocol trace as a Horn theory which we solve using a refinement of resolution. Although we have not been able to prove that this procedure always terminates, we have implemented it and used it to provide the first automated proof of vote privacy of the FOO electronic voting protocol.

In Chapter 6, we study composition of protocols. We show that two protocols that use arbitrary disjoint cryptographic primitives compose securely if they do not reveal or reuse any shared secret. We also show that a form of tagging is sufficient to provide disjointness in the case of a fixed set of cryptographic primitives.

First of all, I would like to thank all the members of the jury and Bruno Blanchet and Luca Viganò in particular for having accepted to review the thesis manuscript.

I would like to thank my advisors, Véronique Cortier and Steve Kremer, who have always managed to make

Résumé

Cette thèse concerne la vérification formelle et la composition de protocoles de sécurité, motivées en particulier par l'analyse des protocoles de vote électronique. Les chapitres 3 à 5 ont comme sujet la vérification de protocoles de sécurité et le Chapitre 6 vise la composition.

Nous montrons dans le Chapitre 3 comment réduire certains problèmes d'une algèbre quotient des termes à l'algèbre libre des termes en utilisant des ensembles fortement complets de variants. Nous montrons que, si l'algèbre quotient est donnée par un système de réécriture de termes convergent et optimalement réducteur (optimally reducing), alors des ensembles fortement complets de variants existent et sont finis et calculables.

Dans le Chapitre 4, nous montrons que l'équivalence statique pour (des classes) de théories équationnelles, dont les théories sous-terme convergentes, la théorie de l'engagement à trappe (trapdoor commitment) et la théorie de signature en aveugle (blind signatures), est décidable en temps polynomial. Nous avons implémenté de manière efficace cette procédure.

Dans le Chapitre 5, nous étendons la procédure de décision précédente à l'équivalence de traces. Nous utilisons des ensembles fortement complets de variants du Chapitre 3 pour réduire le problème à l'algèbre libre. Nous modélisons chaque trace du protocole comme une théorie de Horn et nous utilisons un raffinement de la résolution pour résoudre cette théorie. Meme si nous n'avons pas réussi à prouver que la procédure de résolution termine toujours, nous l'avons implementée et utilisée pour donner la première preuve automatique de l'anonymat dans le protocole de vote électronique FOO.

Dans le Chapitre 6, nous étudions la composition de protocoles. Nous montrons que la composition de deux protocoles qui utilisent des primitives cryptographiques disjointes est sûre s'ils ne révèlent et ne réutilisent pas les secrets partagés. Nous montrons qu'une forme d'etiquettage de protocoles est suffisante pour assurer la disjonction pour un ensemble fixé de primitives cryptographiques.

to my mother, who has always encouraged and supported me in everything I did Chapter 1

Introduction

As the world is getting more and more connected with the advent of the Internet into everyday life, the need for security and privacy of communication has risen considerably. Security and privacy are achieved today by employing security protocols (also called cryptographic protocols). Security protocols are rules for communication between participants which make use of cryptographic primitives such as encryption to provide security guarantees such as confidentiality of data.

Cryptographic Primitives

One of the earliest documented uses of cryptography was by Julius Caesar, who would employ the Caesar cipher [START_REF] Van Tilborg | Encyclopedia of Cryptography and Security[END_REF] to protect messages of military significance. The Caesar cipher and the slightly more sophisticated ciphering methods that followed are known today to be trivially broken using statistical methods. As the need for secure communication increased with the advent of electronic computers and electronic communication, the need for strong ciphers (i.e. which cannot easily be attacked) increased. In 1977 the United States Federal Information Processing Standard adopted the Data Encryption Standard (DES) [START_REF]Data Encryption Standard (DES). Federal Information Processing Standards[END_REF] as a standard. DES enjoyed widespread use internationally; however, due to the small key-length, it quickly became vulnerable to brute-force attacks [START_REF] Loukides | Cracking DES: Secrets of Encryption Research, Wiretap Politics and Chip Design[END_REF]. This led to the adoption of AES (Advanced Encryption Standard) [START_REF]FIPS. Advanced Encryption Standard[END_REF] to supersede DES.

These standards are openly available for anyone to implement and analyze. The openness of the standards follows Kerckhoffs' principle [START_REF] Delfs | Introduction to cryptography: principles and applications[END_REF], widely embraced by the scientific community, which states that a cryptosystem should be secure even if everything about the system, except the key, is public knowledge (i.e. including the algorithms for encrypting or decrypting). Due to the fact that anyone can analyze the security of these ciphers, we gain confidence in their security: if there were a problem with a standard, people would likely find and publish it.

However, ciphers have a big disadvantage in that they require the two parties that are communicating to have the same key; the fact that the same key is used for encryption and decryption is why the key is called a symmetric key and the encryption scheme is called symmetric encryption. Securely sharing a symmetric key can be achieved for example by meeting face-to-face before the sensitive communication takes place and agreeing on the key. However, with the striking development of public key cryptography [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF][START_REF] Diffie | New directions in cryptography[END_REF], another possibility opened up. In public key cryptography, an agent generates a pair of keys: a public key which he shares with everyone and a private key which he keeps to himself. If someone wishes to communicate sensitive information to the agent, he encrypts the plaintext with the public key of the recipient; the recipient in turn receives the ciphertext which may be decrypted using the private key to obtain the original plaintext. Therefore, in theory, there is no more need to meet face-to-face to agree on a shared key. It is sufficient to authentically know the public key of the person which is to receive the sensitive information. Public/private key encryption is also called asymmetric encryption due to the fact that different keys are used for encryption and respectively decryption.

CHAPTER 1. INTRODUCTION

However, in practice, public key encryption is computationally too expensive. Therefore keyestablishment protocols have been developed, in which two participants usually communicate using public key encryption in order to establish a fresh symmetric session key, which they are going to use for the remainder of the session to exchange encrypted messages. This has the advantage of not having to meet in person in order to agree on a symmetric key. Furthermore, the computationally expensive asymmetric cryptography operations are performed only once; after the symmetric session key has been established, messages can be encrypted using symmetric key cryptography, which is computationally less expensive.

Digital signatures [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] also work using private/public key pairs. An agent signs a message using his private key to obtain a signed message. Anyone who knows the public key can verify that the resulting message was indeed signed using the associated private key, thereby allowing to establish the identity of the signer, provided that the public key is known authentically. Authenticity of public keys is a particularly important problem [106, p. 27]. Authenticity in this case means to be sure that a public key indeed belongs to the intended recipient and not to an intruder. Digital signatures form the base of public-key infrastructures (PKIs) [START_REF] Van Tilborg | Encyclopedia of Cryptography and Security[END_REF]. PKIs are designed to bootstrap authenticity as follows. Trusted third party (TTP) institutions such as a government provide certificates which consist of a pair public key -associated identity, pair which is digitally signed by the TTP. By signing the pair, the TTP guarantees that the detainer of the private key associated to the public key has the claimed identity. To check these certificates, the public keys of TTPs are widely distributed via secure channels (for example, every web browser ships with a list of trusted third parties). PKIs usually work in hierarchical way, with higher-level TTPs certifying lower-level TTPs which in their turn provide certificates.

The security of the exchanged messages relies on the security of the cryptographic primitives involved. For ciphers such as AES, confidence in their security results from the fact that even if a large number of person-hours were devoted to trying to break it, no successful practical attack was found. For public key encryption and digital signatures, confidence in their security is higher due to the fact that there are mathematical proofs which show that breaking the encryption or the signature scheme (e.g. by finding the private key associated to a known public key) is equivalent to solving problems which are widely believed to be computationally difficult [START_REF] Goldwasser | Probabilistic encryption[END_REF]. Computational difficulty means that the problem requires a lot of computational resources such as time and memory, which would make it intractable for anyone to solve it in reasonable time.

Security of Protocols

The algorithms for symmetric key encryption, for public key encryption and decryption and for digital signatures are called cryptographic primitives since they are used as part of more complex protocols. The security of cryptographic primitives is analyzed individually: in the case of asymmetric key cryptography, the primitives are proven to be secure via a reduction to an intractable problem and in the case of symmetric key encryption, security is established heuristically.

However, even if the security primitives are secure by themselves, combining them to obtain security protocols such as key establishment protocols might prove to be insecure for several reasons. One of the first examples of this is the Kerberos [START_REF] Steiner | Kerberos: An authentication service for open network systems[END_REF] protocol. The Kerberos protocol is based on the Needham-Schroeder Shared Key (NSSK) protocol, introduced by the Needham and Schroeder in [START_REF] Needham | Using encryption for authentication in large networks of computers[END_REF]. The goal of the protocol is to establish a session key between two agents who already share a secret key with the same trusted server. Denning and Sacco identified [START_REF] Denning | Timestamps in key distribution protocols[END_REF] in 1981 an attack against the NSSK protocol. The attack allows the intruder to force an agent to accept as session key an already compromised key. As a fix to the NSSK protocol, Denning and Sacco propose timestamping certain message of the protocol. Participants are expected to check the timestamp and to ignore messages which have an expired timestamp.

In 1995, Lowe [START_REF] Lowe | An attack on the Needham-Schroeder public-key authentication protocol[END_REF] identified a flaw in the Need-Schroeder Public Key (NSPK) protocol, published by Needham and Schroeder in the same article [START_REF] Needham | Using encryption for authentication in large networks of computers[END_REF] as the NSSK protocol. The goal of the NSPK protocol is to mutually authenticate two parties via a trusted server using public key cryptography. If an honest agent initiates a session with the impostor, the attack identified by Lowe allows the impostor to make it look to another party that he is the honest agent. What is interesting about the Denning-Sacco attack against NSSK and the Lowe attack against NSPK is that these attacks do not attack the underlying encryption schemes, but the logical structure of the protocols. For example the Lowe attack on NSPK will work no matter which public key encryption scheme is used.

A more recent example of a protocol which is insecure (despite the cryptographic primitives employed being secure) is the implementation of a Single Sign-On protocol by Google. A Single Sign-on protocol is designed to ensure the a user authenticates using the same credentials to several service providers. Armando et al. show [11] that Google's implementation of an SSO protocol is insecure by allowing a dishonest service provider to impersonate a user to another service provider. The attack only exploits the expected behavior of the protocol participants and not any weakness of the underlying cryptographic primitives.

The Dolev-Yao Model

As attacks can have serious economic, military and social repercussions, there is a significant need to gain confidence that the security protocols that we use are not vulnerable to attacks. In their seminal paper [START_REF] Dolev | On the security of public key protocols[END_REF], Dolev and Yao identify the need to formally specify security protocols and to formally verify their expected security properties, independently from the security of the underlying cryptographic primitives. This has given the rise to a class of models for security protocols generically called the Dolev-Yao model.

The main ingredient of the Dolev-Yao model is that messages exchanged by parties are represented as terms in a term algebra, with function symbols representing cryptographic primitives. In the Dolev-Yao model, protocols are modeled in various formalisms such as a set of roles in rolebased models [START_REF] Millen | Constraint solving for bounded-process cryptographic protocol analysis[END_REF], sets of strands in strand-spaces-based modes [START_REF] Fábrega | Strand spaces: proving security protocols correct[END_REF], and processes in process algebra based models [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF]3]. The power of the intruder is modeled as a deduction system [START_REF] Amadio | On the reachability problem in cryptographic protocols[END_REF][START_REF] Millen | Constraint solving for bounded-process cryptographic protocol analysis[END_REF], as an equational theory [3] or as the combination of a deduction system with an equational theory [START_REF] Goubault-Larrecq | Alternating two-way AC-tree automata[END_REF]. Additionally, the intruder can intercept all messages, block any message, construct new messages according to the deduction rules, impersonate a protocol agent and send messages of his own creation to the agents.

Once the various details described above are fixed, a model of the security protocol can be created. It remains to model the security property that we expect of the protocol. Traditionally, two security properties are verified:

1. secrecy (or confidentiality) of some secret value, which intuitively means that the attacker cannot find the secret value and 2. authentication, which means intuitively that an agent is talking to whom he believes to be talking.

Secrecy is usually modeled as non-deducibility [START_REF] Rusinowitch | Protocol insecurity with finite number of sessions and composed keys is NP-complete[END_REF] and authentication is modeled as an implication in some form of temporal logic [START_REF] Lowe | A hierarchy of authentication specifications[END_REF]. There are other types of security properties such as vote privacy which can be verified in the case of electronic voting protocols; we discuss them in greater detail in the next section.

Once models of the security protocol and of the expected security property are built, we can proceed to verify if the model of the protocol satisfies the expected property. The act of formally verifying that a model satisfies a property is called model checking (as in Figure 1.1). In our case, the model is the model of a security protocol and the property to be checked is a security property.

Modeling Cryptographic Primitives

In order to gain more confidence in the security of the protocol, the model should in general describe as accurately as possible the protocol. Initially, the Dolev-Yao model allowed only for a fixed set of cryptographic primitives including (symmetric) encryption modeled by a function The inference rules allow the adversary to construct new messages from messages already known either by encrypting known data x with known key y to obtain enc(x, y) or by decrypting an already-known encrypted message enc(x, y) by the already-known associated encryption key y to obtain x (the fact that the intruder can learn new message by observing network traffic is implicit and there is no need to capture this explicitly in the inference rules). Due to the lack of other inference rules, the only way for the attacker to find the contents of an encrypted message is by knowing the encryption key. This is known as the perfect encryption hypothesis [START_REF] Pereira | On the perfect encryption assumption[END_REF] and has been criticized due to the fact that it is not realistic.

Attempts to weaken [START_REF] Cortier | A survey of algebraic properties used in cryptographic protocols[END_REF] the perfect encryption assumption included adding an equational theory to the term algebra. For example, homomorphic encryption [START_REF] Lafourcade | Intruder deduction for the equational theory of abelian groups with distributive encryption[END_REF], where the sum of two ciphertexts is the ciphertext of the sum of the two plaintexts, can be modeled by the following equation: enc(x, y) + enc(z, y) = enc(x + z, y).

Terms are then interpreted in the quotient algebra. Another use of equational theories is to model cryptographic primitives such as exclusive or (XOR) [START_REF] Chevalier | An NP decision procedure for protocol insecurity with XOR[END_REF], denoted here as ⊕:

x ⊕ 0 = x x ⊕ x = 0 x ⊕ (y ⊕ z) = (x ⊕ y) ⊕ z x ⊕ y = y ⊕ x.
It turns out that using equational theories allows one to get rid entirely of the deduction system by adding a function symbol dec modeling the decryption algorithm and satisfying the following equation: dec(enc(x, y), y) = x.

Modeling the decryption algorithm as a function symbol (dec) is called the Dolev-Yao model with explicit destructors [START_REF] Delaune | A decision procedure for the verification of security protocols with explicit destructors[END_REF].

Verifying Security Protocols

Once a model has been fixed, the complexity of the model checking problem should be investigated. In general, model checking of security protocols is undecidable [START_REF] Heintze | A model for secure protocols and their compositions[END_REF][START_REF] Durgin | Multiset rewriting and the complexity of bounded security protocols[END_REF]. The undecidability proof is quite robust in the sense that reasonable variations of the problem are undecidable as well. Therefore, more restricted versions of the model checking problem were considered. The case of a bounded number of sessions (i.e. when each user is only allowed to run the protocol for a bounded number of times) was considered ([118, 43, 42, 41, 54, 8, 32]) and it was shown that for several sets of usual cryptographic primitives, the insecurity problem (i.e. does a message remain secret) is NP-complete [START_REF] Rusinowitch | Protocol insecurity with finite number of sessions and composed keys is NP-complete[END_REF][START_REF] Chevalier | An NP decision procedure for protocol insecurity with XOR[END_REF]. Another approach to get round the undecidability is to verify sound approximations of protocols. An approximation of a protocol is sound whenever showing that the approximation is secure, the protocol is also secure. Conversely, it may be that approximations are subject to attacks which are not attacks of the real protocol. A number of theoretical results and tools [START_REF] Cremers | The Scyther Tool: Verification, falsification, and analysis of security protocols[END_REF]12,[START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF][START_REF] Escobar | Maude-NPA: Cryptographic protocol analysis modulo equational properties[END_REF] show how to soundly approximate security protocols in order to prove them secure.

Another line of work is to reinforce security of existing protocols. It was shown that tagging [START_REF] Heather | How to prevent type flaw attacks on security protocols[END_REF][START_REF] Li | Preventing type flaw attacks on security protocols with a simplified tagging scheme[END_REF] can be added to a protocol to stop type-flaw attacks, i.e. attacks that arise due to messages being confounded for something else. It was also shown that by dynamic tagging [10], a protocol which is secure for one session is secure for an unbounded number of sessions. Finally, there are ways [START_REF] Cortier | Synthesizing secure protocols[END_REF] to compile a protocol which is secure in a weak sense into a protocol which is secure against a full attacker.

Composing Security Protocols

Yet another aspect is modularity. Even though protocols have been shown to be individually secure, there are typically several of them running at the same time. Undesired interactions among protocols which are individually secure could lead to security problems. Therefore protocol compositionality is studied. It was shown for example that protocols which are disjoint in a certain sense compose well [START_REF] Guttman | Protocol independence through disjoint encryption[END_REF][START_REF] Guttman | Cryptographic protocol composition via the authentication tests[END_REF]. Using different tags for different protocols [START_REF] Cortier | Safely composing security protocols[END_REF][START_REF] Cortier | Safely composing security protocols[END_REF] also leads to secure protocols composition. Another way to ensure compositionality is to make the protocols compositional from the very beginning [START_REF] Canetti | Universally composable security: A new paradigm for cryptographic protocols[END_REF][START_REF] Canetti | Universal composition with joint state[END_REF], by the security definition. Compositionality is desired for several reasons:

1. first of all, it is not possible to foresee all of the protocols which may run on a network such as the Internet at the same time. Therefore it is desirable to have protocols which are compositionally secure, i.e. such that the global result is secure;

2. secondly, even if a global model of all protocols were constructible, it would be very difficult to model check it since it would probably be very complex.

We have seen a very brief survey of the state-of-the-art in the literature on verification and composition of protocols in the Dolev-Yao model.

Electronic Voting Protocols

Recent advances in computer technology have made it possible for electronic voting to be more widely deployed. Electronic voting (e-voting) offers many advantages over classical voting, in that the sum of the votes can be computed very quickly and more accurately (since a computer does the counting of the votes).

However, while electronic voting is more convenient, it comes with several risks as it has the potential to make abuse easier to perform on a large scale. A dishonest agent could try to attack the protocol in order to change the tally of the result. Furthermore, the dishonest agent could be (part of) the voting authorities. Therefore electronic voting protocols should be designed to be secure even in the presence of corrupted officials. Furthermore, the terminal on which the voting is performed could be infected by malware and therefore it cannot be trusted.

These issues can be mitigated by a form of auditing that is called verification. E-voting protocols for which the tally can be verified to be correct after the election are said to have the verifiability [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF] property. Verifiability comes in several shapes. Individual verifiability means that every individual should be able to verify that his vote has been taken into account in the final tally. Universal verifiability means that anyone should be able to verify that the tally includes votes only from the eligible voters and that each eligible voter voted at most once. Sometimes eligibility verifiability (i.e. all votes came from eligible voters) is separated from universal verifiability and is seen as a distinct property [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF].

An important aspect in e-voting protocols is vote privacy. Vote privacy means that the link between a voter and his vote remains secret to anyone except the voter, including corrupted voting authorities. Vote privacy is essential in e-voting protocols in order to prevent retaliation against political dissidents.

Another property that is desirable of e-voting protocols is receipt-freeness. Receipt-freeness essentially prevents vote selling and it means that a voter cannot convince anyone else that he voted a certain way. Such a proof would act as a "receipt" and would allow a voter to sell his vote. Related to receipt-freeness is coercion-resistance. A protocol is coercion-resistant if an attacker cannot force a voter to vote a certain way (i.e. by blackmailing him or by holding a gun to his head). The property of fairness means that no partial results of the vote are revealed during the election and that only eligible voters can cast a valid vote.

We can see that in contrast to security properties such as confidentiality or authentication which are traditionally verified for cryptographic protocols, the security properties which are expected of electronic voting protocols seem to be much richer.

At this point, it might be tempting to try and reduce vote privacy to a confidentiality problem which was shown to be co-NP-complete for certain cryptographic primitives and a bounded number of sessions [START_REF] Rusinowitch | Protocol insecurity with finite number of sessions and composed keys is NP-complete[END_REF]. The confidentiality (or secrecy) problem is, given a protocol P and a message s, can the intruder compute s?

Protocol P confidentiality?

Message s The secrecy problem However, it is not possible to reduce vote privacy to secrecy because all of the votes are known to the intruder! Indeed, the votes are well-known to everybody before the election takes place: they can be either 'yes'/'no' in case of binary election or a set of names in case of electing an official. Furthermore, in some cases, it is not possible to have vote privacy: assume that everyone voted 'yes'. The fact that the vote of every individual must have been 'yes' follows directly from the tally which is supposedly publicly announced at the end of the election.

However, vote privacy can be modeled as an equivalence property. Delaune, Kremer and Ryan propose such a definition of vote privacy in [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]: a protocol satisfies vote privacy if the actual run of the protocol is indistinguishable from the run where two participants swap their votes.

Properties such as vote privacy, coercion-resistance and receipt-freeness can be expressed in terms of indistinguishability from the point of view of the attacker. We have seen for example that P {V 1 → "yes", V 2 → "no"} ≈ P {V 1 → "no", V 2 → "yes"} is a way of specifying vote privacy, where P is the voting process, V 1 and V 2 represent the votes of two participants and ≈ denotes indistinguishability form the point of view of the attacker. In contrast to equivalence properties, confidentiality and authentication are trace properties in the sense that it is sufficient to look at any individual run (also called a trace) of the protocol to conclude that they hold or not. In contrast, it is necessary to look at all runs globally in order to establish an equivalence property.

We have shown that electronic voting protocols are special because they are expected to have much richer security properties than the traditional secrecy and authentication properties. Furthermore, to ensure these properties, e-voting protocols make use of rather esoteric cryptographic primitives [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF][START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF] such as blind signatures [START_REF] Chaum | Blind signatures for untraceable payments[END_REF], trapdoor commitments [START_REF] Okamoto | An electronic voting scheme[END_REF] and homomorphic encryption [START_REF] Hirt | Efficient receipt-free voting based on homomorphic encryption[END_REF].

In contrast to the tools which are available to prove and reason about authenticity and confidentiality, there are not so many tools available for reasoning about equivalence properties which are needed for establishing the security of e-voting protocols. Furthermore, existing tools are usually limited to handling a fixed set of cryptographic primitives which usually exclude the more esoteric primitives required by e-voting protocols.

We have shown that properties such as vote privacy are fundamentally different from secrecy properties: vote privacy is an equivalence property while secrecy is a trace property. Furthermore, receipt-freeness and coercion-resistance can also be modeled as equivalence properties [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. Therefore, in order to verify that protocols satisfy such properties, it is sufficient to devise a procedure for the equivalence problem:

Input:
two protocols P and Q Output: is P indistinguishable from Q? (i.e. P ≈ Q).

The relation ≈ should model behavioral equivalence between processes, i.e. two protocols which are in the ≈ relation should be indistinguishable to the intruder. Usually, ≈ is taken to be observational equivalence, but it seems that trace equivalence is a better alternative [START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF]. In this thesis, we will only consider the case where ≈ is trace equivalence. It is well-known that in general, the equivalence problem is undecidable since is generalizes the secrecy problem. Therefore various restrictions of the problem are usually considered.

Contributions

In this thesis, we show that automated verification of security protocols with respect to equivalence properties is feasible for certain classes of bounded protocols and that protocols making use of arbitrary disjoint cryptographic primitives compose well with respect to confidentiality. We detail our contributions below.

The Strong Finite Variant Property

In Chapter 3, we introduce the notion of a strongly complete set of variants of a term. Strongly complete sets of variants allow in many cases to get rid of the equational theory and solve problems in the free term algebra. We compare (Section 3.4) the notion of strongly complete set of variants to the notion of complete set of variants, already introduced in [START_REF] Comon-Lundh | The finite variant property: How to get rid of some algebraic properties[END_REF] and we show that they are different ( 3.4.1); however, in the presence of free symbols, the problem of finding strongly complete sets of variants can be reduced to the problem of computing complete sets of variants ( 3.4.2). We show that convergent optimally reducing term rewriting systems have finite strongly complete sets of variants. Optimally reducing term rewriting systems include rewrite systems which are relevant to security protocols such as subterm convergent term rewriting systems, blind signatures, trapdoor commitment and others.

Strongly complete sets of variants are motivated by our procedure in Chapter 5 that checks equivalence between processes. In this procedure, strongly complete sets of variants are used to get rid of the equational theory and reduce the problem to the free algebra.

Furthermore, strongly complete sets of variants are of independent interest, because they allow to construct finite complete sets of unifiers for equational unification problems as shown in Section 3.6. This chapter is based on work presented at the UNIF 2011 workshop [START_REF] Ciobâcȃ | Computing finite variants for subterm convergent rewrite systems[END_REF] and it has been implemented in the tool SubVariant [START_REF] Ciobâcȃ | [END_REF].

Related Work

The notion of finite set of variants was introduced by Comon and Delaune in [START_REF] Comon-Lundh | The finite variant property: How to get rid of some algebraic properties[END_REF]. It can be useful for solving unification and disunification properties [START_REF] Comon-Lundh | The finite variant property: How to get rid of some algebraic properties[END_REF][START_REF] Escobar | Variant narrowing and equational unification[END_REF] and in getting rid of the equational theory for the verification of reachability in security protocols [START_REF] Delaune | Vérification des protocoles cryptographiques et propriétés algébriques[END_REF]. Methods for proving and for disproving the finite variant property are given in [START_REF] Escobar | Effectively checking the finite variant property[END_REF]. As opposed to previous work which considers the general case of a convergent term rewriting system modulo an equational theory E, we restrict ourselves to the case where E is empty. In this case (where E is empty) we extend the notion of complete set of variants to the notion of strongly complete set of variants. This is needed in order to obtain complete sets of unifiers constructively and to get rid of the equational theory in our procedure (Chapter 5) for verifying trace equivalence.

A Decision Procedure for Static Equivalence

In Chapter 4 we show that the equivalence problem is decidable for a large class of equational theories and for a passive attacker. A passive attacker is allowed to listen to network traffic, but it cannot modify, block or send new messages on the network. Therefore, in the case of a passive attacker, the equivalence problem can be reduced to the static equivalence problem, which is, given two sequences of (ground) messages S 1 and S 2 , can the intruder distinguish between S 1 and S 2 ? Deciding static equivalence is a prerequisite to deciding more general equivalences which take into account the dynamic behavior of the protocol. Furthermore, static equivalence is interesting in its own right because it helps to partially automate equivalence proofs.

Our procedure is based on the encoding into Horn clauses of the two sequences of messages and of the possible intruder actions. A carefully tuned refinement of resolution can then be used to saturate the set of Horn clauses. From the saturated set of Horn clauses, it is easy to decide if the two sequences of messages are equivalent. Our procedure is sound and complete for any equational theory which is modeled as a convergent term rewriting system. Furthermore, we have shown that our procedure always terminates for several (classes of) equational theories particularly relevant to e-voting protocols, including subterm convergent rewrite systems, trapdoor commitment and blind signatures. Most notably, this is the first decidability result for static equivalence under trapdoor commitment, a cryptographic primitive which is used in e-voting protocols such as Okamoto [START_REF] Okamoto | Receipt-free electronic voting schemes for large scale elections[END_REF] to ensure receipt-freeness. We also show that by using a fair saturation process, we obtain decidability of static equivalence for an equational theory modeling a homomorphic encryption scheme.

As a by-product, the same procedure can be used to decide the intruder deduction problem for the same class of equational theories. The intruder deduction problem is, given a set of (ground) messages S and another term t, can the intruder apply deduction rules in order to derive t from S? The intruder deduction problem can be seen as the restriction of the confidentiality problem to a passive adversary (i.e. an adversary which can intercept messages on the network, but which cannot modify them).

Our procedure for deciding static equivalence and the intruder deduction problem terminates in polynomial time for several equational theories including blind signatures, trapdoor commitment and subterm convergent equational theories. It was implemented in the KiSs tool and it is based on work published in [START_REF] Ciobâcȃ | Computing knowledge in security protocols under convergent equational theories[END_REF][START_REF] Ciobâcȃ | Computing knowledge in security protocols under convergent equational theories[END_REF].

Related Work

Many decision procedures have been proposed for the intruder deduction problem (e.g. [START_REF] Chevalier | Résolution de problèmes d' accessibilité pour la compilation et la validation de protocoles cryptographiques[END_REF]8,[START_REF] Lafourcade | Intruder deduction for the equational theory of abelian groups with distributive encryption[END_REF][START_REF] Chevalier | Key substitution in the symbolic analysis of cryptographic protocols[END_REF]) under a variety of equational theories. We do not discuss these here and we concentrate on work which is directly related to static equivalence. In [2] a decidability result is obtained for a class of equational theories which are locally stable and locally decidable. This class include subterm convergent rewrite systems, for which a polynomial-time procedure is shown to exist. In [START_REF] Cortier | Deciding knowledge in security protocols for monoidal equational theories[END_REF], several decision results are shown for monoidal equational theories. A combination result (if deduction and static equivalence are decidable for two disjoint equational theories, then deduction and static equivalence are also decidable for the union of the two theories) was obtained in [START_REF] Arnaud | Combining algorithms for deciding knowledge in security protocols[END_REF]. An algorithm inspired by [2] which can handle subterm convergent rewrite theories and blind signatures was published in [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF][START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF] and implemented in [START_REF] Baudet | YAPA (Yet Another Protocol Analyzer)[END_REF]. A procedure designed and implemented to obtain asymptotically faster algorithms for static equivalence than [START_REF] Baudet | YAPA (Yet Another Protocol Analyzer)[END_REF]45] is given in [START_REF] Conchinha | Fast: An efficient decision procedure for deduction and static equivalence[END_REF], although it cannot handle more cryptographic primitives. Procedures for verifying behavioral equivalences such as implemented in ProVerif [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF][START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF] can also prove static equivalence; but they are "overkill" in the sense that they were designed for a more difficult problem. Furthermore, none of them can handle the theory of trapdoor commitment.

Automated Verification of Trace Equivalence

In Chapter 5, we show that the automated verification of equivalence properties is feasible by giving a procedure for verifying equivalence between bounded determinate security protocols without else branches. Our procedure is sound and complete for equational theories having the strong finite variant property which we introduce in Chapter 3. Therefore our procedure works for subterm convergent equational theories (which allow to model classical cryptographic primitives such as symmetric and asymmetric encryption, digital signatures, hash functions) but also for blind signatures and trapdoor commitment, as all of these are optimally reducing and have therefore the strong finite variant property.

Our procedure is based on a fully-abstract modeling of each symbolic trace of a process into a set of Horn clauses. This modeling of symbolic traces into Horn clauses extends the Horn clauses in Chapter 4 by taking into account the dynamic behavior of the symbolic trace. We use strongly complete sets of variants and complete sets of equational unifiers to get rid of the underlying equational theory. Therefore the Horn clauses are interpreted in the free term algebra. A carefully crafted refinement of resolution is then used to saturate the set of clauses. From the saturated set of clauses, it is easy to check if two symbolic traces are equivalent. Furthermore, if two determinate processes are given as sets of symbolic traces, we show how to check from the respective saturated sets of clauses if the two processes are trace equivalent.

However, many electronic voting protocols are not determinate and therefore we cannot directly apply this result to reason about them. However, in Section 5.9.1 we present a method for proving that two nondeterminate processes are equivalent, method which uses equivalence checking for two symbolic traces as a subroutine. This allows us to prove (Section 5.9.3) vote privacy of the FOO [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF] e-voting protocol. This is the first provably sound and fully automated proof of vote privacy for this protocol. However, our method is incomplete in that two processes could be trace equivalent but the methods fails to prove it.

As we have already explained, our procedure for automatically verifying trace equivalence is based on the saturation of a set of Horn clauses. We conjecture that the saturation always terminates for subterm convergent rewrite systems. Unfortunately, due to the highly complex form of the structures involved in the procedure, we have not been able to show this. However, we have implemented the procedure in the tool AKiSs and we have used it to prove vote privacy of the FOO [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF] e-voting protocol. This is the first provably sound automatic proof of vote privacy for this protocol. An article based on this work was published in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF].

Related Work

Undecidability of observational equivalence in the spi calculus, even for the finite control fragment, was shown by Hüttel [START_REF] Hüttel | Deciding framed bisimilarity[END_REF]. In the same paper, a decision result is given for the finite, replicationfree, fragment of the spi calculus [START_REF] Hüttel | Deciding framed bisimilarity[END_REF] for a fixed, limited set of cryptographic primitives. An automated tool [START_REF] Durante | Automatic testing equivalence verification of spi calculus specifications[END_REF] can check observational equivalence for the finite, replication-free fragment of the spi-calculus with a limited set of cryptographic primitives. Symbolic bisimulations have also been devised for the spi [START_REF] Borgström | Symbolic bisimulation in the spi calculus[END_REF][START_REF] Borgström | Equivalences and Calculi for Formal Verifiation of Cryptographic Protocols[END_REF] and applied pi calculus [START_REF] Delaune | Symbolic bisimulation for the applied pi calculus[END_REF][START_REF] Liu | A complete symbolic bisimulation for full applied pi calculus[END_REF] to avoid unbounded branching due to adversary inputs. However, only [START_REF] Delaune | Symbolic bisimulation for the applied pi calculus[END_REF] and [START_REF] Borgström | Symbolic bisimulation in the spi calculus[END_REF] yield an automated procedure for proving equivalence, but again only approximating observational equivalence. In [START_REF] Tiu | Automating open bisimulation checking for the spi calculus[END_REF], the authors present a decision procedure for checking open bisimulation for a variant of the spi-calculus with a fixed set of cryptographic primitives.

A highly non-deterministic decision procedure for checking equivalence of constraint systems (or equivalently, of two symbolic traces) is given by Baudet [START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF]. An alternate procedure achieving the same goal was proposed by Chevalier and Rusinowitch [START_REF] Chevalier | Decidability of equivalence of symbolic derivations[END_REF]. Due to the high degree of nondeterminism involved, it seems that the two procedures are not implementable. Therefore, Cheval et al. [START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF] have designed a new procedure and a prototype tool to decide the equivalence of constraint systems, but only for a fixed set of primitives. For a restricted class of simple processes it was shown [START_REF] Cortier | A method for proving observational equivalence[END_REF] that observational equivalence coincides with trace equivalence and that the later is decidable by using as a subroutine a decision procedure for checking equivalence of constraint systems. The procedure for constraint systems in [START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF] was generalized to trace equivalence [START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF] for finite processes with a fixed set of primitives, but the new procedure has not been implemented.

ProVerif [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF] can prove strong secrecy [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF] and diff-equivalence [START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF], an equivalence between processes that differ only in their choice of terms and which is stronger than observational equivalence. However, ProVerif cannot verify vote privacy of the FOO electronic voting protocol except with the use of the add-on ProSwapper [START_REF] Smyth | Formal verification of cryptographic protocols with automated reasoning[END_REF] which was not shown to be sound. ProVerif translated protocols into Horn clauses and employs sound abstractions that allow it to prove equivalences for an unbounded number of sessions. However, it may fail to terminate and because of the abstractions it can produce false attacks.

Other approaches [START_REF] Weidenbach | ]) for all 1 ≤ i ≤ n -1. By Lemma A.19, we have that can(l i σ) ≃ can(r i σ). By Corrolary A.3, we[END_REF][START_REF] Goubault-Larrecq | Deciding H 1 by resolution[END_REF] based on Horn clauses also perform abstractions and allow for false attacks. For the case of confidentiality properties, precise encodings (without false attacks) into Horn clauses have been proposed and implemented in [6]. However, the encoding is for a fixed set of cryptographic primitives, it does not take into account that processes may block (due to a test failing) and it works only for confidentiality.

Composability

In Chapter 6, we establish a composition result with respect to confidentiality properties. We show that two protocols which use disjoint cryptographic primitives modeled by arbitrary disjoint equational theories can be securely composed as soon as they do not reveal shared secrets and when the shared secrets are not reused. This is the first composition result which allows to make use of arbitrary cryptographic primitives in the active case, all previous results assuming a limited fixed set of primitives or a tagging scheme.

Our work allows us for example to securely compose a key-establishment protocol with another protocol using the established key, as long as the two protocols use disjoint cryptographic primitives. This also holds in the case where key-establishment is performed several times and the respective keys are used. The composition result holds for an unbounded number of sessions. We also show that employing a form of tagging is sufficient to ensure disjointness in the case of encryption and hash functions. We show this by reducing the composition of the tagged protocols to the composition of two protocols which used disjoint equational theories.

One limitation of our approach is that it cannot cope with dishonest agents due to the hypothesis that shared secrets (between the two protocols which are to be composed) are not revealed. Dishonest users would reveal such secrets immediately and therefore our composition result does not give any guarantee in this case. The work in this chapter has been presented at CSF 2010 [START_REF] Ciobâcȃ | Protocol composition for arbitrary primitives[END_REF].

Related Work

One of the first papers studying the composition of protocols in the symbolic model is [START_REF] Guttman | Protocol independence through disjoint encryption[END_REF]. In the formalism of strand spaces [START_REF] Fábrega | Strand spaces: proving security protocols correct[END_REF], Guttman and Thayer show that two protocols which make use of concatenation and encryption can be safely executed together without damaging interactions, as soon as the protocols are "independent". In [START_REF] Cortier | Safely composing security protocols[END_REF], Cortier et al show that tagging is sufficient to avoid collusion between protocols sharing common keys and making use of standard cryptographic primitives: concatenation, signature, hash functions and encryption. This framework allows to compose processes symmetrically; however, it does not allow to securely compose e.g. a key exchange protocol with another protocol which makes use of the shared key. In [START_REF] Guttman | Cryptographic protocol composition via the authentication tests[END_REF], Guttman provides a characterization which ensures that two protocols can run securely together when sharing some data such as keys or payloads. The main improvement over [START_REF] Guttman | Protocol independence through disjoint encryption[END_REF] is that keys are allowed to be non-atomic.

In [START_REF] Delaune | Composition of password-based protocols[END_REF], Delaune et al. use a derivative of the applied-π calculus to model off-line guessing attacks. They show that in the passive case resistance against guessing attacks is preserved by the composition of two protocols which share the weak secret against which the attack is mounted. This result (in the passive case) holds for arbitrary equational theories. However, for the active case this is no longer the case: it is however proven that tagging the weak secret enforces secure composition (in the sense of guessing attacks). This framework applies to parallel composition only.

Mödersheim and Viganò [START_REF] Mödersheim | Secure pseudonymous channels[END_REF] have proposed a framework for composing protocols sequentially. In [START_REF] Delaune | Simulation based security in the applied pi calculus[END_REF], Delaune et al. use a simulation based approach inspired from the computational model to provide a framework for securely composing protocols in the applied-π calculus. This involves defining for each sub-protocol an ideal functionality and then showing that a certain implementation securely emulates the ideal functionality. In [START_REF] Groß | Vertical protocol composition[END_REF], Groß and Mödersheim introduce vertical protocol compositions, where a key-exchange protocol is coupled with a protocol (called application protocol) which uses the exchanged key. Vertical compositions are similar to the sequential compositions we have used in this work. Another line of work is represented by the Protocol Composition Logic [START_REF] Datta | Protocol composition logic (PCL)[END_REF], which can be used to modularly prove security properties of protocols using a fixed set of primitives; however, the proofs may be rather involved and are not automatic.

Thesis Plan

Chapter 2 introduces notations and concepts standard in the literature. In Chapter 3, we introduce the notion of strongly complete set of variants of a term, we discuss its relation to the notion of complete set of variants, and we show that optimally reducing term rewriting systems have finite strongly complete sets of variants. Furthermore, we show how to construct finite complete sets of unifiers for equational unification problems from the strongly complete sets of variants of the terms involved. In Chapter 4, we discuss a decision procedure for the intruder deduction problem and for the static equivalence problem for a class of convergent equational theories including subterm convergent rewrite systems, trapdoor commitment and blind signatures. In Chapter 5, we give a procedure for verifying indistinguishability between finite number of sessions of security protocols. We have implemented the procedure and we have used the implementation, among others, to prove vote privacy of the FOO [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF] e-voting protocol. In Chapter 6, we establish a composition result with respect to confidentiality properties. We show that two protocols which use disjoint cryptographic primitives modeled by arbitrary disjoint equational theories can be securely composed as soon as they do not reveal shared secrets and when the shared secrets are not reused. We also show that employing a form of tagging is sufficient to ensure disjointness in the case of encryption and hash functions. Chapter 7 concludes the thesis with a summary of the results obtained and presents perspectives and possible future work.

Chapter 2

Preliminaries

In this chapter, we review several standard concepts and definitions in term algebra and term rewriting theory.

Term Algebra

Let F be a signature, i.e. a finite set of function symbols. Let ar be a function associating to each function symbol a natural number, called the arity of the symbol. A function of arity 0 is called a constant.

We let X , N , M, W, C be pairwise disjoint, countably infinite sets of variables, private names, public names, parameters and public channels, respectively. We assume furthermore that X , N , M, W and C, which will act as atoms in the term algebra, are disjoint from F. We will note by A the entire set of atoms (A = X ∪ N ∪ M ∪ W ∪ C).

Given a signature F ′ that is a subset of F (F ′ ⊆ F) and a set of atoms A ′ that is a subset of the global set of atoms (A ′ ⊆ A), we define the set T (F ′ , A ′ ) of all F ′ -terms over A ′ as the smallest set such that:

1. all atoms in A ′ are terms (A ′ ⊆ T (F ′ , A ′ )), 2. for all function symbols f ∈ F ′ of arity ar(f ) = k and all terms t 1 , . . . , t k ∈ T (F ′ , A ′ ), we have that f (t 1 , . . . , t k ) ∈ T (F ′ , A ′ ) (i.e. application of function symbols to terms yields terms).

The set of positions of a term t ∈ T (F, A) is a set Pos(t) of strings over the alphabet of positive integers, defined inductively such that:

1. if t ∈ A, then Pos(t) = {ǫ}, where ǫ denotes the empty string, and

2. if t = f (t 1 , . . . , t k ) with f ∈ F, then Pos(t) = {ǫ} ∪ k i=1 {ip | p ∈ Pos(t i )}.
where juxtaposition denotes string concatenation. The size |t| of the term t, is the cardinality of Pos(t).

For every position p ∈ Pos(t) of the term t, the subterm t| p of the term t at the position p is defined by induction on the length of p to be:

t| ǫ = t f (t 1 , . . . , t k )| iq = t i | q CHAPTER 2. PRELIMINARIES
For all terms s ∈ T (F, A) and for every position p ∈ Pos(t) of the term t, we denote by t[s] p the term that is obtained by placing the term s at position p in the term t, i.e.

t[s] ǫ = s f (t 1 , . . . , t k )[s] iq = f (t 1 , . . . , t i-1 , t i [s] q , t i+1 , . . . , t k )
The set of subterms st(t) of the term t is the set st(t) = {s | there exists p ∈ Pos(t) such that t| p = s}.

The set Var (t) is the set of variables of the term t, i.e.

Var (t) = {x | there exists p ∈ Pos(t) such that t| p = x ∈ X }.
The set N ames(t) is the set of names of the term t, i.e.

N ames(t) = {n | there exists p ∈ Pos(t) such that t| p = a ∈ N ∪ M}.

The set Symbols(t) is the set of function symbols of the term t, i.e. Symbols(t) = {f | there exists p ∈ Pos(t) and t 1 , . . . , t n such that t| p = f (t 1 , . . . , t n )}.

We extend the functions Var , N ames and Symbols on tuples of terms, sets of terms and combinations thereof in the expected manner. We say that the term t is ground if Var (t) = ∅.

A substitution is a function σ : X → T (F, A) such that σ(x) = x for only finitely many variables x ∈ X . The finite set of variables Dom(σ) = {x | σ(x) = x} is called the domain of the substitution σ. The range Range(σ) of the substitution σ is the set Range(σ) = {σ(x) | x ∈ Dom(σ)}. If Dom(σ) ⊆ {x 1 , . . . , x n }, we may write σ as

σ = {x 1 → σ(x 1 ), . . . , x n → σ(x n )}.
The homomorphic extension of a substitution σ to the set of terms T (F, A) is the function σ : T (F, A) → T (F, A), where

σ(x) = σ(x) for all variables x ∈ X σ(a) = a for all non-variable atoms a ∈ A \ X σ(f (t 1 , . . . , t k )) = f (σ(t 1 ), . . . , σ(t k ))
for all other terms f (t 1 , . . . , t k ).

We identify as usual substitutions with their homomorphic extensions and we may write substitution application in suffix form: the term tσ is the application of the homomorphic extension σ of the substitution σ to the term t, i.e. tσ = σ(t).

The identity substitution σ = {} is the only substitution with empty domain Dom(σ) = {} and, when applied to a term t, it does not change it: t = t{}. If X ⊆ X is a set of variables and σ is a substitution, then σ[X] is the restriction of σ to X, i.e. the substitution such that σ

[X](x) = σ(x) if x ∈ X and σ[X](x) = x if x ∈ X \ X.
The restriction operator enjoys the following property, which we are going to use several times later on: Lemma 2.1. Let t be a term and let σ be a substitution. If X ⊇ Var (t) then tσ = t(σ[X]).

We let ⊎ denote the disjoint union of two sets. In particular, if σ and τ are two substitutions with disjoint domains (Dom(σ) ∩ Dom(τ ) = ∅), we denote by γ = σ ⊎ τ the substitution of domain Dom(γ) = Dom(σ) ∪ Dom(τ ) such that γ(x) = σ(x) if x ∈ Dom(σ) and γ(x) = τ (x) if x ∈ X \Dom(σ). The composition στ of two substitutions σ and τ is defined to be the substitution which associates to any variable x the term (xσ)τ , i.e. στ (x) = τ (σ(x)). Substitution composition enjoys the following property, which we are going to use several times later on:

Lemma 2.2. Let σ 1 , σ 2 , σ 3 , σ 4 be substitutions such that σ 1 [X] = (σ 2 σ 3 )[X] and σ 3 [X∪Var (Range(σ 2 ))] = σ 4 [X ∪ Var (Range(σ 2 ))] for some set of variables X. Then σ 1 [X] = (σ 2 σ 4 )[X].
Proof. Let x ∈ X be an arbitrary variables in the set X. If x ∈ Dom(σ 2 ), we have that Var (σ 2 (x)) ⊆ Var (Range(σ 2 )). If x ∈ Dom(σ 2 ), we have that Var (σ 2 (x)) = Var (x) = {x} ⊆ X. In either case, we have that Var (σ 2 (x)) ⊆ X ∪ Var (Range(σ 2 )). Therefore

(σ 3 [X ∪ Var (Range(σ 2 ))])(σ 2 (x)) = (σ 4 [X ∪ Var (Range(σ 2 ))])(σ 2 (x)) = xσ 2 (σ 4 [X ∪ Var (Range(σ 2 ))]).
As Var (xσ 2 ) ⊆ X ∪Var (Range(σ 2 )), it follows by Lemma 2.

1 that xσ 2 (σ 4 [X ∪Var (Range(σ 2 ))] = xσ 2 σ 4 .
We have shown that

xσ 2 σ 3 = xσ 2 σ 4 . As x ∈ X was chosen arbitrarely in X, it follows that σ 2 σ 3 [X] = σ 2 σ 4 [X]. But σ 1 [X] = σ 2 σ 3 [X] and therefore, by transitivity, σ 1 [X] = σ 2 σ 4 [X].
A substitution σ is called a variable renaming if Dom(σ) = Range(σ). We say that σ is a variable renaming from the set of variables X ⊆ X to the set of variables Y ⊆ X if Dom(σ) ⊆ X ∪Y and σ(x) ∈ Y for all variables x ∈ X.

If A 0 is a set of atoms, a replacement of terms is a function σ : D → T (F, A 0 ) such that D is a finite set of terms D ⊆ T (F, A 0 ). The application of a replacement σ : D → T (F, A 0 ) to a term t is written in suffix notation tσ and is defined inductively to be:

tσ = σ(t) if the term t ∈ D is in the domain D of σ tσ = a if the term t = a ∈ A \ D is an atom not in the domain D of σ tσ = f (t 1 σ, . . . , t k σ) if the term t = f (t 1 , . . . , t k ) ∈ D is not in the domain of σ A (k-)context C ∈ T (F, A ∪ { 1 , . . . , k }
) is a term with distinguished variables 1 , . . . , k such that each variable i appears at most once in C. We write C[t 1 , . . . , t k ] for the term C{ 1 → t 1 , . . . , k → t k }.

Unification

Two terms s, t ∈ T (F, A) are (syntactically) unifiable if there exists a substitution σ such that sσ = tσ. The substitution σ is then a unifier of s and t. A unifier σ of s and t is called more general than another unifier τ if there exists a substitution ω such that τ = σω.

It is well known [START_REF] Baader | Unification theory[END_REF] that any two unifiable terms s and t admit a most general unifier mgu(s, t), i.e. a unifier which is more general than any other unifier. Furthermore, any two most general unifiers σ and τ of two unifiable terms s and t can be obtained from each other by composition with a variable renaming. We make therefore a slight abuse of language and speak of the most general unifier mgu(s, t) of s and t (which is unique up to variable renaming), as is common in term rewriting literature.

Rewriting

Equational Theories

An identity over F ′ ⊆ F is a pair (s, t) ∈ T (F ′ , X ) × T (F ′ , X ), where × denotes the cartesian product of sets. We will write identities (s, t) ∈ T (F, X ) × T (F, X ) as s ≈ t.

If E = {s 1 ≈ t 1 , . . . , s n ≈ t n } is a set of identities, we will denote by = E the smallest relation on terms containing E and such that:

1. = E is reflexive: t = E t for all terms t ∈ T (F, A), 2. = E is transitive: s = E r and r = E t implies s = E t for all terms s, r, t ∈ T (F, A), 3. = E is symmetric: s = E t implies t = E s for all terms s, t ∈ T (F, A), 4. = E is closed under substitutions: s = E t implies sσ = E tσ for all terms s, t ∈ T (F, A) and all substitutions σ and 5. = E is closed under F-operations:

s 1 = E t 1 , . . . , s k = E t k implies f (s 1 , . . . , s k ) = E f (t 1 , . . . , t k )
for all function symbols f of arity ar(f ) = k and for all terms s 1 , . . . , s k , t 1 , . . . , t k ∈ T (F, A).

The relation = E is called the equational theory generated by the set of identities E. We will sometimes make an abuse of language and call E an equational theory.

We write s → E t if there exist a context C, an identity

s i ≈ t i ∈ E and a substitution σ such that s = C[s i σ] and t = C[t i σ] or vice-versa, if s = C[t i σ] and t = C[s i σ]. It is well known that → *
E , the transitive and reflexive closure of → E , coincides with = E [START_REF] Baader | Term rewriting and all that[END_REF]. Two substitutions σ and τ are equal modulo E, written σ = E τ , if σ(x) = E τ (x) for all x ∈ X .

Equational Unification

Two terms s, t ∈ T (F, A) are unifiable in the equational theory E (or E-unifiable) if there exists a substitution σ such that sσ = E tσ. The substitution σ is then an E-unifier of s and t. A set of substitutions mgu E (s, t) is called a complete set of E-unifiers of s and t if:

1. any substitution σ ∈ mgu E (s, t) is an E-unifier of s and t: sσ = E tσ and 2. any E-unifier τ of s and t is an instance modulo E of some substitution σ ∈ mgu E (s, t) on the variables of s and t: there exist a substitution σ ∈ mgu E (s, t) and a substitution

ω such that τ [Var (s, t)] = E σω[Var (s, t)].
An equational theory is called finitary if, for any two terms s, t ∈ T (F, A) there exists a finite complete set of E-unifiers (mgu E (s, t) is finite).

Rewrite Systems

A rewrite rule is an identity l ≈ r such that l ∈ X and Var (r) ⊆ Var (l) 1 . In this case we may write l → r instead of l ≈ r. A term rewriting system R = {l 1 → r 1 , . . . , l n → r n } is a finite set of rewrite rules. We write s → R t if there exist a position p ∈ Pos(s), a rewrite rule l → r ∈ R and a substitution σ of domain Dom(σ) ⊆ Var (l) such that s| p = lσ and t = s[rσ] p . The relation → R is then called the one-step rewrite relation of R, the reflexive transitive closure of → R is denoted by → * R and the reflexive transitive symmetric closure of → R is denoted ↔ * R . We also write = R instead of ↔ * R . A rewrite system R implements an equational theory E if the relations = R and = E coincide. If R = {l 1 → r 1 , . . . , l n → r n } is a term rewriting system and E = {l 1 ≈ r 1 , . . . , l n ≈ r n } is the associated equational theory, it is known that R implements E (see for example [START_REF] Baader | Term rewriting and all that[END_REF]).

A rewrite system R is terminating if there is no infinite rewrite chain t 1 → R t 2 → R . . .. A rewrite system R is confluent if for all terms s, u, v such that s → * R u and s → * R v we have that there exists a term t such that u → * R t and v → * R t. A rewrite system is convergent if it is both terminating and confluent. An equational theory is convergent if it is implementable by a convergent rewrite system. A term t is in normal form or normalized (with respect to a rewrite system R) if t → R s for any term s. A term t is a normal form of a term s (with respect to a rewrite system R) if t is in normal form with respect to R and s → * R t. It is well known (see e.g. [START_REF] Baader | Term rewriting and all that[END_REF]) that if R is a convergent rewrite system, any term t has a unique normal form with respect to R. In this case (when R is convergent) we will denote with t↓ R the normal form of t.

We say that a rewrite rule l → r is in R up to renaming, and we write l → r ∈ R if there exist a rewrite rule l ′ → r ′ ∈ R and a variable renaming τ such that l = l ′ τ and r = r ′ τ .

If σ is a substitution, we will denote by σ↓ R the substitution which assigns to any variable x the term (xσ)↓. We say that a substitution σ is in normal form (with respect to R) if σ = σ↓ R . If R is clear from the context, we sometimes omit R and use ↓ instead of ↓ R .

Subterm Convergent Rewrite Systems

Definition 2.1. A term rewriting system R is subterm convergent if it is convergent and every rewrite rule l → r ∈ R is such that subterm rule r ∈ st (l) or extended rule r is a ground term in normal form with respect to R.

The first type of rewrite rule justifies the name of this class of rewrite systems and was originally the only type of rewrite rule allowed [1] in subterm convergent rewrite systems. The second type of rule represents a small but useful extension introduced in [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF]. In this thesis, we consider the extended version of subterm convergent rewrite systems as defined above. We say that an equational theory E is subterm convergent if there is a subterm convergent rewrite system R that implements the equational theory E. Subterm convergent rewrite systems allow the modeling of many usual cryptographic primitives such as symmetric encryption:

Example 2.1. Let R = {dec(enc(x, y), y) → x}. It is easy to see that R is subterm convergent. The function symbol enc models symmetric encryption and the function symbol dec symmetric decryption. The only rewrite rule models the fact that decryption cancels out encryption when the correct key is used.

Optimally Reducing Rewrite Systems Definition 2.2. A rewrite rule l → r ∈ R is called optimally reducing if, for any substitution θ such that all strict subterms of lθ are in normal form, we have that rθ is in normal form. A term rewriting system R is optimally reducing if all rewrite rules l → r ∈ R are optimally reducing.

Optimally reducing term rewriting systems were introduced in [START_REF] Narendran | On the unification problem for cartesian closed categories (extended abstract)[END_REF]. It is easy to see that any subterm convergent rewrite system is an optimally reducing rewrite system. Additionally, optimally reducing rewrite systems allow to model cryptographic primitives which cannot be modeled by subterm convergent rewrite systems, as shown in the following example.

Example 2.2. The term rewriting system R defined bellow is convergent and optimally reducing. However, R is not subterm convergent because of its second rewrite rule.

R = check(sign(x, y), pk(y)) → x unblind(sign(blind(x, y), z), y) → sign(x, z)
The term rewriting system R models blind signatures, especially useful in modeling electronic voting protocols [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF].

The function symbol sign represents the signing algorithm: the term sign(s, t) denotes the signature of the message t with the private key t. The function symbol check allows to verify a signature using the public key pk(y) of the party having signed the message.

The blind function symbol allows a party to "blind" a message x with a blinding factor y, thereby obtaining the blob blind(x, y). The blob can then be signed by a party using the private key z to obtain sign(blind(x, y), z) and then, using the unblinding function symbol unblind, to obtain via the second rewrite rule the message sign(x, z). This allows the party that has blinded the message to obtain a signature of x without revealing what x is. This is particularly useful in voting protocols, where a voter can have his vote signed by the voting authority without revealing the vote itself [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF].

Free symbols

A function symbol f ∈ F is free with respect to a rewrite system R = {l 1 → r 1 , . . . , l n → r n } if the function symbol f ∈ Symbols(l 1 , r 1 , . . . , l n , r n ) does not appear in any of the identities of R.

We have that:

Theorem 2.1. If R is a convergent rewrite system and f ∈ F is a free function symbol of arity

ar(f ) = k, then f (t 1 , . . . , t k )↓ = f (t 1 ↓, . . . , t k ↓).
Proof. We will first show by induction on the number of rewrite steps that if

f (t 1 , . . . , t k ) → * R t, then t = f (s 1 , . . . , s k ) for some terms s 1 , . . . , s k such that t 1 → * R s 1 , . . . , t k → * R s k .
Indeed, for the base case, if the number of rewrite steps is 0, we choose s 1 = t 1 , . . . , s k = t k and we have that

t 1 → * R s 1 , . . . , t k → * R s k as → * R is reflexive.
For the inductive case, we assume by the induction hypothesis that

f (t 1 , . . . , t k ) → * R f (s ′ 1 , . . . , s ′ k ) such that t i → * R s ′ i for all 1 ≤ i ≤ k and we show that if f (s ′ 1 , . . . , s ′ k ) → R t, then t = f (s 1 , . . . , s k ) such that t i → * R s i for all 1 ≤ i ≤ k. As f (s ′ 1 , . . . , s ′ k ) → R t, it follows that there exists a rewrite rule l → r ∈ R, a position p ∈ Pos(t) and a substitution σ such that f (s ′ 1 , . . . , s ′ k )| p = lσ and t = f (s ′ 1 , . . . , s ′ k )[rσ] p .
As f is free with respect to R, it follows that f ∈ Symbols (l). Furthermore, by the definition of a rewrite system, l ∈ X . Therefore l and f (s ′ 1 , . . . , s ′ k ) are not unifiable. Therefore p = ǫ cannot be the empty position. Therefore p = jq for some index 1 ≤ j ≤ k and some position q.

We have therefore that

t = f (s ′ 1 , . . . , s ′ k )[rσ] p = f (s ′ 1 , . . . , s ′ k )[rσ] jq is equal, by the definition of •[•] • , to f (s ′ 1 , . . . , s ′ j-1 , s ′ j [rσ] q , s ′ j+1 , . . . , s ′ k ). Let s i = s ′ i for all 1 ≤ i ≤ k such that i = j and let s j = s ′ j [rσ] q . By the definition of → R , we have that s ′ j → R s j . By reflexivity of → * R , we have that s ′ i → * R s i for all 1 ≤ i ≤ k if i = j. Therefore s ′ i → * R s i for all 1 ≤ i ≤ k. But t i → * R s ′ i for 1 ≤ i ≤ k
and, by transitivity of → * R , we have t i → * R s i for all 1 ≤ i ≤ k. We have shown that t = f (s 1 , . . . , s k ) such that t i → * R s i for all 1 ≤ i ≤ k, thereby concluding the inductive step.

We have just proved by induction on the number of rewrite steps that if f (t 1 , . . . , t k ) → * R t, then t = f (s 1 , . . . , s k ) for some terms s 1 , . . . , s k such that t i → * R s i for all 1 ≤ i ≤ k. Furthermore, if f (s 1 , . . . , s k ) is in normal form, we have that s 1 , . . . , s k are also in normal form. Therefore, if f (s 1 , . . . , s k ) is the normal form of f (t 1 , . . . , t k ), it follows that s i is the normal form of t i for all

1 ≤ i ≤ k. Therefore f (t 1 , . . . , t k )↓ = f (t 1 ↓, . . . , t k ↓).

Modeling Messages as Terms

In order to formally assess the security of cryptographic protocols, we use a mathematical model of such protocols. First of all, we model messages exchanged between the parties during the protocol run as terms in a term algebra. Cryptographic primitives such as encryption are modeled as function symbols and the cryptographic properties of the primitives are modeled as an equational theory.

Example 2.3. We let F = {enc, dec}, where ar(enc) = ar(dec) = 2. The term enc(m 1 , m 2 ) represents the message denoting the encryption of the message modeled by the term m 1 with the key modeled by the term m 2 .

Let E = {dec(enc(x, y), y) = x} be an equational theory. We have that the term dec(enc(m 1 , m 2 ), m 3 ) represents the result of decrypting the message enc(m 1 , m 2 ) by the key m 3 . If m 2 = E m 3 , we have that dec(enc(m 1 , m 2 ), m 3 ) = E m 1 (the decryption succeeds).

Base data such as atomic keys are modeled as names. Names can be private (the set N is the set of private names) if the intruder does not a priori know them, or they can be public (the set M is the set of public names) in case the intruder knows them a priori.

Example 2.4. Continuing the previous example, a freshly generated key can be modeled as the term k ∈ N and the public name yes ∈ M can be used to model a well-known representation of the vote 'yes'.

The set of terms representing messages is defined to be Messages = T (F, N ∪ M).

Example 2.5. Continuing the previous example, if we let m 1 = yes and m 2 = k, we have that the term enc(m 1 , m 2 ) = enc(yes, k) represents the message constructed by encrypting the vote 'yes' with a fresh key k that is a priori unknown to the intruder.

Frames

We fix an enumeration w 1 , w 2 , . . . of the elements of the set W. The atoms w 1 , w 2 , . . . are not used as building blocks in messages, but are used by the attacker to point to messages exchanged during the protocol. The parameter w 1 refers to the first message exchanged, w 2 to the second, etc. This suggests a way of modeling sequences of messages exchanged during a protocol:

Definition 2.3. A frame ϕ is a substitution {w 1 → t 1 , . . . , w n → t n } where t i ∈ Messages (1 ≤ i ≤ n) are terms representing messages.
Note that in our definition, every frame with |Dom(ϕ)| = n has Dom(ϕ) = {w 1 , . . . , w n }.

Deduction

The adversary can use the messages learnt from the run of a protocol to construct new messages. Messages can be constructed by applying function symbols to already known messages and by referring to the parameters. The adversary knows a priori all public names. We denote by Recipes F = T (F, M ∪ W) the set of recipes constructible over a given signature F, i.e. terms used by the intruder to construct messages. If the signature F is obvious from context, we also write Recipes instead of Recipes F . The relation between recipes and the resulting messages is modeled as the deducibility relation. Definition 2.4. We say that the term t is deducible from ϕ with a recipe r in the equational theory E (written as ϕ ⊢ r E,F t) if r ∈ Recipes F and rϕ = E t.

If the signature F is obvious from context, we write ⊢ E instead of ⊢ E,F . If the equational theory is also obvious from context, it can be omitted. If the equational theory E is implemented by a rewrite system R, then we also write ⊢ R instead of ⊢ E .

Example 2.6. Continuing the previous example, let ϕ = {w 1 → enc(yes, k), w 2 → k} be a frame representing the sequence of messages from a toy voting protocol. The first message exchanged during the protocol was the encryption of the vote 'yes' under a fresh key k. The second message is the value of the key that was used to protect the vote in the first message.

The fact that the intruder does not a priori know k is modeled by the fact that ϕ ⊢ k k, since k ∈ N and therefore k ∈ Recipes. However, the intruder can deduce the value of k indirectly, by referring to w 2 : ϕ ⊢ w2 k.

We also have that the intruder can get the value of the vote 'yes' either indirectly, as ϕ ⊢ dec(w1,w2) yes or directly, since ϕ ⊢ yes yes (as yes ∈ M, a public name, can be used in the recipe).

Static Equivalence

The deduction relation described previously is enough to model secrecy of data: we can model the fact that a private name s remains secret after the protocol run if ϕ ⊢ r s for any recipe r, where ϕ represents the frame collecting all messages from the protocol. However, for more subtle properties, deduction is not enough.

Example 2.7. Consider for example a voting protocol where the possible votes are 'yes' and 'no'. The values of any vote are a priori known to the intruder (e.g. ϕ ⊢ yes yes for any frame ϕ).

Therefore, the fact that the vote of an individual voter remains private cannot be modeled by the fact that the name yes (representing a 'yes' vote) or that the name no ∈ M (representing a 'no' vote) cannot be deduced from the frame.

Instead, to express the fact that the value of the vote is not revealed, we ask that the intruder is not be able to distinguish a run of the protocol where 'yes' was voted from a run of the protocol where 'no' was voted. This indistinguishability relation is modeled as static equivalence: Definition 2.5. A test r 1 ? = r 2 holds in a frame ϕ (written (r 1 = r 2 )ϕ) if ϕ ⊢ r1 t and ϕ ⊢ r2 t for some t, i.e., r 1 and r 2 are recipes for the same term in ϕ. If (r 1 = r 2 )ϕ, we sometimes say that r 1 = r 2 is an identity that holds in ϕ.

A frame

ϕ 1 is statically included in ϕ 2 (written ϕ 1 ⊑ s ϕ 2 ) iff for all r 1 , r 2 we have that (r 1 = r 2 )ϕ 1 implies (r 1 = r 2 )ϕ 2 .
Two frames ϕ 1 and ϕ 2 are statically equivalent (written

ϕ 1 ≈ s ϕ 2 ) iff ϕ 1 ⊑ s ϕ 2 and ϕ 2 ⊑ s ϕ 1 .
Example 2.8. Let ϕ = {w 1 → enc(yes, k), w 2 → k} and let ϕ ′ = {w 1 → enc(no, k), w 2 → k}.

The frame ϕ can represent the messages in a run of a protocol where 'yes' was voted, while ϕ ′ can represent the messages in a the run of the same protocol where 'no' was voted. We have that ϕ ≈ s ϕ ′ , since the following test dec(w 1 , w 2 ) ? = yes holds in ϕ but not in ϕ ′ . We can conclude that the privacy of the vote is not preserved, since the two frames are distinguishable.

Chapter 3

The Strong Finite Variant Property

Introduction

Given a term (e.g. t = dec(x, y)) and a convergent rewrite system (e.g. R = {dec(enc(x, y), y) → x}), we are interested in having a convenient symbolic representation of all normal forms tσ↓ of instantiations tσ of the term t. In the above case, the normal form tσ↓ of tσ falls into one of the following two cases:

1. either σ(x)↓ = enc(s, σ(y)↓) is an encryption of some term s with the term σ(y)↓, in which case σ↓[{x, y}] = σ 1 τ 1 [{x, y}] for σ 1 = {x → enc(z, y)} and τ 1 = {z → s, y → σ(y)↓} and therefore tσ↓ = (tσ 1 )↓τ 1 .

2. or σ(x)↓ is not such an encryption (σ(x)↓ = enc(s, σ(y)↓) for any term s), in which case σ↓[{x, y}] = σ 2 τ 2 [{x, y}] for σ 2 = {} (the identity substitution) and τ 2 = σ↓ and therefore

tσ↓ = (tσ 2 )↓τ 2 .
The set of terms {tσ i ↓} (in this example, 1 ≤ i ≤ 2) is then called a complete set of variants of t since any normal form tσ↓ of an instantiation tσ of the term t will be a syntactic instantiation of a term tσ i ↓ (for some 1 ≤ i ≤ 2).

Rewrite systems for which finite complete sets of variants can be found for any term t are said to have the finite variant property (from hereon FVP). The FVP is useful in symbolic analysis of security protocols [START_REF] Comon-Lundh | The finite variant property: How to get rid of some algebraic properties[END_REF] and in solving unification and disunification problems [START_REF] Comon-Lundh | The finite variant property: How to get rid of some algebraic properties[END_REF][START_REF] Escobar | Variant narrowing and equational unification[END_REF], since they allow to get rid of the rewrite system and solve the resulting problems syntactically.

Complete sets of variants were introduced in [START_REF] Comon-Lundh | The finite variant property: How to get rid of some algebraic properties[END_REF] by Comon and Delaune. In their work, the normal form of a term is defined modulo some equational theory (typically AC). Their work includes showing that several rewrite systems have the finite variant property: the standard Dolev Yao theory with explicit descriptors (modulo the empty equational theory), a presentation of abelian groups (modulo AC) and a presentation of the Diffie-Hellman cryptographic primitives (modulo AC). Another line of work [START_REF] Escobar | Effectively checking the finite variant property[END_REF] proposes algorithms for proving and for disproving that a certain rewrite theory has or does not have the finite variant property.

In this thesis, we restrict ourselves to working modulo the empty equational theory and therefore we consider syntactic normal forms. Furthermore, since the complete set of variants {tσ i ↓} of t is fully determined by t and the set of substitutions {σ i }, we will from now speak of substitutions σ i as being the variants of t and we will say that the set {σ i } is a complete set of variants of t. In Section 3.2 we recall the definition of FVP in our setting.

Our work in this chapter is motivated by the procedure for verifying security protocols that we describe in Chapter 5. We define a notion of strongly complete set of variants (Section 3.3), which is a stronger version of the complete set of variants. Rewrite systems having finite strongly complete sets of variants for any term are said to have the strong finite variant property (from hereon SFVP).

We discuss the differences between the SFVP and the FVP in Section 3.4. In particular, in the presence of free symbols of arity ≥ 2, the two notions coincide. In the same section, we also compare strongly complete sets of variants with complete sets of variants and we show a link between the two.

In Section 3.5, we investigate the SFVP for convergent optimally reducing rewrite systems, which are useful for modeling many cryptographic primitives. We show that convergent optimally reducing rewrite systems have the strong finite variant property and we give an algorithm to compute a finite strongly complete set of variants for a given term and a given optimally reducing rewrite system. In chapter 5, strongly complete sets of variants allow us to get rid of the underlying rewrite system in our procedure for verifying security protocols.

In Section 3.6, we show that having the strong finite variant property is sufficient for equational unification problems to have finite complete sets of unifiers. The proof is constructive: a finite complete set of unifiers of an equation modulo the rewrite system is built from the strongly complete sets of variants of the two terms in the equation.

The two applications of our work, namely the procedure for verifying security protocols in Chapter 5 and the computation of finite complete sets of unifiers in Section 3.6 show that the notion of strongly complete set of variants is more natural and more useful than the notion of a complete set of variants. This chapter is based on work [START_REF] Ciobâcȃ | Computing finite variants for subterm convergent rewrite systems[END_REF] that has been presented at the UNIF 2011 workshop. The algorithms presented here have been implemented in the tool SubVariant [START_REF] Ciobâcȃ | [END_REF].

The Finite Variant Property (FVP)

Formally, the finite variant problem is to find finite complete sets of variants for a term: Definition 3.1. A complete set of variants of a term t with respect to a convergent term rewriting system R is a set of substitutions {σ 1 , . . . , σ n } such that for any substitution π, we have that (tπ)↓ = ((tσ i )↓)τ for some index 1 ≤ i ≤ n and some substitution τ .

In the above definition, the difficulty of finding a complete set of variants lies in the fact that the term (tσ i )↓τ is not normalized anymore after the application of the substitution τ to (tσ i )↓. Therefore the set consisting of the identity substitution is in general not a complete set of variants.

Example 3.1. Let t = dec(x, y) and R = {dec(enc(x, y), y) → x}. We have that the set consisting of the substitution σ 1 = {} (the identity substitution) and of the substitution σ 2 = {x → enc(z, y)} is a complete set of variants of t. We prove that {σ 1 , σ 2 } is a complete set of variants of t by choosing a substitution τ for any substitution π as follows:

1. if the decryption does not succeed (i.e. xπ↓ = enc(t ′ , yπ↓)), then we let τ = π↓ and we have that (dec(x, y)π)↓ = dec(x, y)(π↓) = (dec(x, y)σ 1 )↓τ .

2. if xπ↓ = enc(t ′ , yπ↓) (i.e. the decryption succeeds), then we let τ = {z → t ′ } and we have that (dec(x, y)π)

↓ = t ′ = z{z → t ′ } = (dec(x, y)σ 2 )↓{z → t ′ }.
A term rewriting system R has the FVP if any term t ∈ T (F, A) has a finite complete set of variants. The following example illustrates that not all rewrite systems have the FVP.

Example 3.2. We consider the term rewriting system R = {f (g(x)) → g(f (x))} and the term t = f (x). By analyzing the sequence of substitutions π i = {x → g i (y)} (for all i ∈ N) and the normal forms (tπ i )↓ = g i (f (y)) (for all i ∈ N), it can be proven that any complete set of variants of t will contain all of the substitutions:

σ i = {x → g i (y)}
for all i ∈ N and up to renaming of the variable y. Therefore this term rewriting system does not have the FVP.

The Strong Finite Variant Property

The notion of FVP was introduced in [START_REF] Comon-Lundh | The finite variant property: How to get rid of some algebraic properties[END_REF]. In the procedure for verifying security protocols that we describe in Chapter 5, we require a slightly stronger notion, which motivates the following definition: Definition 3.2. Let t be a term with the set of variables Var (t) = X. A set of substitutions {σ 1 , . . . , σ n } is called a strongly complete set of variants of t if the substitutions σ i (1 ≤ i ≤ n) are of domain Dom(σ i ) ⊆ X for all 1 ≤ i ≤ n and for any substitution π, we have that (π[X])↓ = ((σ i ↓)τ )[X]1 for some substitution τ and some index 1

≤ i ≤ n such that (tπ)↓ = ((tσ i )↓)τ .
The difference between a complete set of variants and a strongly complete set of variants is that we require not only that (tπ)↓ be equal to (tσ i )↓τ , but also that π↓ and (σ i ↓)τ coincide on the variables of t.

Note that in the above definition the condition π[X]↓ = (σ i ↓τ )[X] is not sufficient in the sense that it does not in general imply (tπ)↓ = (tσ i )↓τ : take R = {dec(enc(x, y), y) → x}, t = dec(x, y), π = {x → enc(z, y)}, σ i = {} (the identity substitution). We have that τ = π is such that π[X]↓ = (σ i ↓τ )[X] = τ [X] but (tπ)↓ = z = (tσ i )↓τ = dec(enc(z, y), y).

As with complete sets of variants, a finite strongly complete set of variants does not exist in general. As expected, rewrite systems R for which any term t has a finite strongly complete set of variants are said to have the strong finite variant property (from hereon SFVP).

The notion of strongly complete set of variants is stronger than the notion of complete set of variants. It is obvious that a strongly complete set of variants is always a complete set of variants.

The following example illustrates that the reverse is not true and reveals the subtlety between a complete set of variants and a strongly complete set of variants. Example 3.3. We consider the (subterm convergent) term rewriting system R = {h(f (x), y) → y, h(g(x), y) → y} and the term t = h(x, y).

It is easy to see that the following set S is a complete finite set of variants of t:

S = {σ 1 = {}, σ 2 = {x → f (z)}}.
Note that S does not contain the substitution σ 3 = {x → g(z)}. Even if S is a finite complete set of variants of t it is not a strongly complete set of variants of t: if we consider the substitution π = {x → g(a)} for some constant a, we have that:

1. π↓[X] = (σ 1 ↓)τ 1 [X] (with τ 1 = {x → g(a)}), but (tπ)↓ = ((tσ 1 )↓)τ 1 . 2. π↓[X] = (σ 2 ↓)τ 2 [X] for any substitution τ 2 .
where X = Var (t) is the set of variables of t. However, the set S ∪ {σ 3 } is a strongly complete set of variants of t.

3.4 Relating the SFVP and the FVP

Strict Containment

It is easy to see that a term rewriting system having the SFVP also has the FVP. The reverse is not true: term rewriting systems having the FVP need not have the SFVP. Let us consider the signature F = {f /1, g/1} and the following convergent term rewriting system

R = {f (g(x)) → f (x)}.
It is easy to see that any term t has a normal form which is either the term t↓ = g n (f m (x)) or the term t↓ = g n (f m (a)) for some variable x ∈ X , non-variable atom a ∈ A \ X and integers n, m ∈ N. We will show that the identity substitution {} forms by itself a complete set of variants of any term t built over the signature F.

Proof. Let σ be an arbitrary substitution and t be an arbitrary term.

1. If t↓ = g n (f m (a)) for some non-variable atom a ∈ A \ X, then (tσ)↓ = ((t↓)σ)↓ = t↓ = (t{})↓{}.

2. If t↓ = g n (f m (x)) for some variable x ∈ X , let the term s = σ(x) be the value of σ at x. We have that s↓ = g p (f q (y)) or s↓ = g p (f q (b)) for some variable y ∈ X , non-variable atom b ∈ A \ X and some integers p, q ∈ N.

(a) if s↓ = g p (f q (y)) then i. if m = 0, we have tσ↓ = g n+p (f q (y)) = (t{})↓σ and ii. otherwise, if m > 0, we have tσ↓ = g n (f m+q (y)) = (t{})↓{x → f q (y)}.

(b) if s↓ = g p (f q (b)) then i. if m = 0, we have tσ↓ = g n+p (f q (b)) = (t{})↓σ and ii. otherwise, if m > 0, we have (tσ)↓ = g n (f m+q (b)) = (t{})↓{x → f q (b)}.

We have shown that the identity substitution forms by itself a complete set of variants of any term t over F. However, R does not have the SFVP. This is illustrated by the following example.

Example 3.4. Let t = f (x) be a term where x ∈ X is a variable. By analyzing the instantiations tπ i where the substitutions π i are defined as π i = {x → g i (y)} for all i ∈ N, it can be shown that any strongly complete set of variants must contain substitutions σ i for all i ∈ N such that σ i [{x}] = {x → g i (z)} for all i ∈ N (up to renaming of z). Therefore any strongly complete set of variants of t is infinite.

In the Presence of Free Symbols

We have shown that in general the SFVP is a strictly stronger property than the FVP.

However, if the signature contains at least a free symbol of arity strictly greater than 1, we show that the two notions coincide. Let f ∈ F be the free symbol of arity ar(f ) = k ≥ 2. From hereon, we will denote by tuple(t 1 , . . . , t n ) the term

tuple(t 1 , . . . , t n ) = f (t 1 , t, . . . , t, f (t 2 , t, . . . , t, f (• • • f (t n , t, . . . , t))))
where t is an arbitrary ground term in normal form (for example a constant in normal form or a name).

Example 3.5. If k = 3, then tuple(a, b, c) = f (a, t, f (b, t, f (c, t, t))).
Because f is a free symbol, we have by Theorem 2.1 that tuple(t 1 , . . . , t n )↓ = tuple(t 1 ↓, . . . , t n ↓).

(3.1)

The following theorem shows that in the presence of at least a free symbol f of arity k ≥ 2 the two notions (FVP and SFVP) coincide. Note that the presence of a free symbol does not make the notions of complete sets of variants and of strongly complete sets of variants coincide; however a strongly complete set of variants of some term can be constructed by computing a complete set of variants of another, more complex, term.

Theorem 3.1. Let t be a term and let X = {x 1 , . . . , x n } = Var (t) be the set of its variables. Let S be a complete set of variants of tuple(t, x 1 , . . . , x n ). Then

S ′ = {σ[X] | σ ∈ S}
is a strongly complete set of variants of t.

Proof. Let π be an arbitrary substitution. We need to show that there exist a substitution σ ′ ∈ S ′ and a substitution τ ′ such that π[X]↓ = ((σ ′ ↓)τ ′ )[X] and (tπ)↓ = (tσ ′ )↓τ ′ . Because S is a complete set of variants of tuple(t, x 1 , . . . , x n ), we have that there exist a substitution σ ∈ S and a substitution τ such that

(tuple(t, x 1 , . . . , x n )π)↓ = ((tuple(t, x 1 , . . . , x n )σ)↓)τ. (3.2)
By applying Equation 3.1 to each side of the equality we obtain (tuple(t, x 1 , . . . , x n )π)↓ = tuple((tπ)↓, (x 1 π)↓, . . . , (x n π)↓) ((tuple(t, x 1 , . . . , x n )σ)↓)τ = tuple(((tσ)↓)τ, ((x 1 σ)↓)τ, . . . , ((x n σ)↓)τ ) and, as the two terms are equal by Equation (3.2), it follows that every every pair of terms at the same position in the two tuples are equal: (tπ)↓ = ((tσ)↓)τ and x i π↓ = x i σ↓τ for all 1 ≤ i ≤ n. But as {x 1 , . . . , x n } = X, it follows that π[X]↓ = ((σ↓)τ )[X]. As X = Var (t) = {x 1 , . . . , x n }, it immediately follows that (tπ

)↓ = ((t(σ[X]))↓)τ and π[X]↓ = (((σ[X])↓)τ )[X].
As σ ∈ S, we have that σ[X] ∈ S ′ . We have shown therefore that there exist a substitution σ ′ = σ[X] ∈ S ′ and a substitution τ ′ = τ such that π[X] = ((σ ′ ↓)τ ′ )[X] and (tπ)↓ = (tσ ′ )↓τ ′ , thereby proving that S ′ is a strongly complete set of variants of t.

Computing Strongly Complete Sets of Variants for Convergent Optimally Reducing Rewrite Systems

In this section, we present an algorithm for computing strongly complete sets of variants for terms under a convergent optimally reducing rewrite system. The algorithm for computing a strongly complete finite set of variants is based on a refinement of narrowing which is sound and complete for convergent optimally reducing rewrite systems. Each narrowing step (denoted hereafter ֒→) works on a configuration (t, P, X) consisting of a term t, a set of positions P of t at which narrowing is allowed and a set of forbidden variables X in the sense that fresh variables should be chosen outside of X. The main difference between our refinement of narrowing and standard narrowing is that positions at which a narrowing step is performed are restricted by the set P.

In order to describe the refinement of narrowing that we use in our algorithm we first need a new notation: if p is a position, by down(p) we denote the set of positions which is the downward closure of p, i.e. all positions that are descendants of p, including p itself:

down(p) = {pq | for all positions q}. q ∈ P l → r ∈ R
Var ({l, r}) ∩ X = ∅ θ = mgu(l, t| q ) (t, P, X) θ ֒→ (tθ[rθ] q , P \ down(q), X ∪ Var (Range(θ))) To compute a complete finite set of variants of some term t and a convergent optimally reducing rewrite system R, we will begin with the initial configuration

C 0 = (t, Pos init (t), Var (t))
where Pos init (t) = Pos(t) \ {p | t| p ∈ X } is the set of all non-variable positions of t and nondeterministically apply narrowing steps.

Each narrowing step non-deterministically chooses a rewrite rule l → r and a position p from P where narrowing is performed. The initial choice of P = Pos init (t) in the initial configuration is a way to enforce the basic restriction, that is, narrowing is only performed strictly inside t (and not inside the variables of t). Furthermore, if we have performed narrowing at a position p and because of the specificity of convergent optimally reducing rewrite systems, there is no need to consider this position or any of its descendants anymore and therefore they are removed from P. In particular, if n = 0, ֒→ denotes the identity relation. We show that our narrowing procedure allows to compute a finite strongly complete set of variants for any term t: Theorem 3.2 (Correctness). If R is a convergent optimally reducing rewrite system, the set

We write

Σ = {σ = θ 1 . . . θ n | (t, Pos init (t), Var (t)) θ1,...,θn ֒→ (t ′ , P ′ , X ′ )}
is a finite strongly complete set of variants of t.

The proof of correctness of the above theorem relies on the following soundness and completeness lemmas: Lemma 3.1 (Partial Soundness). Let t, t ′ be terms, P, P ′ sets of positions, X, X ′ sets of variables and θ a substitution. If

(t, P, X) θ ֒→ (t ′ , P ′ , X ′ ),
we have that tθ → R t ′ and X ′ = X ∪ Var (Range(θ)).

Proof. By the definition of θ ֒→, we have that if (t, P, X) θ ֒→ (t ′ , P ′ , X ′ ), there exist a rewrite rule l → r ∈ R, a position q and a substitution θ such that t| q θ = lθ. We have that tθ = tθ[lθ] q → R tθ[rθ] q = t ′ . The fact that X ′ = X ∪ Var (Range(θ)) is immediate from the definition of θ ֒→.

By iterating Lemma 3.1, we obtain: Lemma 3.2 (Soundness). Let t, t ′ be terms, P, P ′ sets of positions, X, X ′ sets of variables and θ 1 , . . . , θ n substitutions. If (t, P, X) θ1...θn ֒→ (t ′ , P ′ , X ′ ), we have that tθ 1 . . . θ n → * R t ′ and X ′ = X ∪ Var (Range(θ 1 )) ∪ . . . ∪ Var (Range(θ n )).

Proof. We proceed by induction on n. If n = 0, we have that θ1...θn ֒→ =֒→ is the identity relation. Therefore X ′ = X and tθ 1 . . . θ n = t = t ′ , which implies tθ 1 . . . θ n → * R t ′ .

If n > 0, we have that (t, P, X)

θ1...θn-1 ֒→ (t ′′ , P ′′ , X ′′ ) θn ֒→ (t ′ , P ′ , X ′ )
for some term t ′′ , some set of positions P ′′ and some set of variables X ′′ . By the induction hypothesis, we have that

tθ 1 . . . θ n-1 → * R t ′′ (3.3)
and that

X ′′ = X ∪ Var (Range(θ 1 )) ∪ . . . ∪ Var (Range(θ n-1 )). (3.4)
As (t ′′ , P ′′ , X ′′ ) θn ֒→ (t ′ , P ′ , X ′ ), we have by Lemma 3.1 that

X ′ = X ′′ ∪ Var (Range(θ n )) (3.5)
and that If R is a convergent optimally reducing rewrite system, there exist substitutions θ and ω ′ , a term t ′ , a set of positions P ′ ⊆ Pos(t ′ ) and a set of variables X ′ such that (t, P, X) θ ֒→ (t ′ , P ′ , X ′ ) and

t ′′ θ n → R t ′ . ( 3
ω[X] = θω ′ [X]. Furthermore, Var (t ′ ) ⊆ X ′ and t ′ ω ′ | p is in normal form for every p ∈ Pos(t ′ ω ′ ) \ P ′ .
Proof. As tω is not in normal form, there exists a position q, a rewrite rule l ′ → r ′ ∈ R and a substitution σ ′ of domain Dom(σ ′ ) ⊆ Var (l ′ ) such that tω| q = l ′ σ ′ . Let q be maximal (w.r.t. to its length) with this property.

Let τ be a variable renaming such that Var

({l ′ τ, r ′ τ }) ∩ X = ∅, let l = l ′ τ , r = r ′ τ and σ = τ -1 σ ′ . We have that l → r ∈ R with Var ({l, r}) ∩ X = ∅, tω| q = l ′ σ ′ = l ′ τ τ -1 σ ′ = lσ.
Because tω| q is an instance of the left-hand side of a rewrite rule, we have that tω| q is not in normal form. As tω| p is in normal form for any position p ∈ Pos(tω) \ P by hypothesis, it must be that q ∈ P.

We have shown that q ∈ P; as P ⊆ Pos(t) by hypothesis, we have that q ∈ Pos(t). Therefore tω| q = t| q ω.

As Var (t) ⊆ X, we have that t| q (ω[X]) = t| q ω = tω| q = lσ. As the domains of the substitutions ω[X] (Dom(ω[X]) ⊆ X) and σ (Dom(σ) ⊆ Var (l) and Var (l) ∩ X = ∅) are disjoint, we have that ω[X] ⊎ σ is a unifier of t| q and l.

As t| q and l are unifiable, they have a most general unifier. Let θ = mgu(t| q , l) be a most general unifier of t| q and l. As ω[X] ⊎ σ is a unifier of t| q and l, it follows that it is an instance of their most general unifier: there exists a substitution ω ′ such that ω

[X] ⊎ σ = θω ′ . It easily follows that ω[X] = θω ′ [X] and (3.7) σ[Var (l)] = θω ′ [Var (l)]. (3.8)
Let t ′ = tθ[rθ] q , P ′ = P \ down(q) and X ′ = X ∪ Var (Range(θ)). We have that P ′ ⊆ Pos(t ′ ).

By the definition of θ ֒→, we have that (t, P, X) θ ֒→ (t ′ , P ′ , X ′ ).

(3.9)

As Var (rθ) ⊆ Var (lθ) by the definition of a rewrite rule, we have that Var (t ′ ) = Var (tθ[rθ] q ) ⊆ Var (tθ[lθ] q ) = Var (tθ) ⊆ Var (t) ∪ Var (Range(θ)) and therefore Var (t ′ ) ⊆ X ′ .

To finish the proof, it remains to be shown that t ′ ω ′ | p is in normal form for every position p ∈ Pos(t ′ ω ′ ) \ P ′ . Let p ∈ Pos(t ′ ω ′ ) \ P ′ be an arbitrary position. We will show that t ′ ω ′ | p is in normal form by the following case distinction:

1. if q is a prefix of p (i.e. there exists a position q ′ such that p = qq ′ ), we have that

t ′ ω ′ | p = (tθ[rθ] q )ω ′ | p = rθω ′ | q ′ .
By the definition of a rewrite rule, we have that Var (r) ⊆ Var (l). Furthermore, by Equation (3.8), we have that σ[Var (l)] = θω ′ [Var (l)] and therefore rθω ′ = rσ.

As R is an optimally reducing rewrite system, we have that l → r ∈ R is an optimally reducing rewrite rule. Since q was chosen to be maximal such that tω| q is not in normal form, we have that all strict subterms of lσ = tω| q are in normal form. Therefore, as l → r is optimally reducing, it follows that rσ is in normal form. Therefore any subterm of rσ = rθω ′ is in normal form; in particular the subterm of rσ at position q ′ , t ′ ω ′ | p = rθω ′ | q ′ , is in normal form.

2. p cannot be a prefix of q: we have that tω| p is not in normal form (since it has as subterm lσ). Therefore p ∈ P. But P ′ = P \ down(q) and therefore p ∈ P ′ . But p was chosen arbitrarily in Pos(t ′ ω ′ ) \ P ′ .

3. if p and q are incomparable (w.r.t. the prefix ordering), we have that t ′ ω ′ | p = tω| p and, as p ∈ P ′ and P ′ = P \ down(q), it must be that p ∈ P. Therefore t ′ ω ′ | p = tω| p is in normal form by hypothesis.

We have shown that our choice of θ, t ′ , X ′ , P ′ satisfies each of the properties we wanted and therefore we conclude.

By applying Lemma 3.3 iteratively, we obtain the follow completeness lemma: Lemma 3.4 (Completeness). Let t be a term, ω a substitution, X a set of variables such that Var (t) ⊆ X and P ⊆ Pos(t) a set of positions such that for all p ∈ Pos(tω) \ P, we have that tω| p is in normal form.

If R is a convergent optimally reducing rewrite system, there exist an integer n ≥ 0, substitutions θ 1 , . . . , θ n , a substitution ω ′ , a term t ′ , a set of positions P ′ and a set of variables X ′ such that (t, P, X)

θ1...θn ֒→ (t ′ , P ′ , X ′ ), ω[X] = θ 1 . . . θ n ω ′ [X] and t ′ ω ′ is in normal form. Furthermore, Var (t ′ ) ⊆ X ′ .
Proof. We proceed by induction on tω equipped with the well-founded order → R given by the terminating term rewriting relation. Base case. If tω is already in normal form, we choose n = 0, ω ′ = ω, t ′ = t, X ′ = X and P ′ = P. It trivially follows that (t, P, X)

θ1...θn ֒→ (t ′ , P ′ , X ′ ) (as ֒→= θ1...θn ֒→ is the identity relation), that ω[X] = ω ′ [X], that Var (t ′ ) ⊆ X ′ , that t ′ ω ′ = tω is in normal form.
Inductive case. If tω is not in normal form, we have by Lemma 3.3 We can therefore apply the induction hypothesis on t ′′ and ω ′′ to obtain that there exists m ≥ 0, substitutions ω ′ 1 , . . . , ω ′ m , a substitution ω ′ , a term t ′ , a set of positions P ′ and a set of variables X ′ such that (t ′′ , P ′′ , X ′′ )

θ ′ 1 ...θ ′ m ֒→ (t ′ , P ′ , X ′ ), (3.11
)

ω ′′ [X ′′ ] = θ ′ 1 . . . θ ′ m ω ′ [X ′′ ], Var (t ′ ) ⊆ X ′ and t ′ ω ′ is in normal form. Let n = m + 1, θ 1 = θ and θ i = θ ′ i-1 for 2 ≤ i ≤ n.
֒→ (t ′ , P ′ , X ′ ). We have that ω[X] = θω ′′ [X], that ω ′′ [X ′′ ] = θ ′ 1 . . . θ ′ m ω ′ [X ′′
] and that X ′′ = X∪Var (Range(θ)). By Lemma 2.2, we obtain that ω

[X] = θθ ′ 1 . . . θ ′ m ω ′ [X]. But θ 1 = θ and θ i = θ ′ i-1 for 2 ≤ i ≤ n by choice of θ 1 , . . . , θ n . Therefore ω[X] = θ 1 . . . θ n ω ′ [X].
In both cases, we have shown that there exist n ≥ 0, θ 1 , . . . , θ n , t ′ , P ′ , X ′ such that (t, P, X)

θ1...θn ֒→ (t ′ , P ′ , X ′ ), ω[X] = θ 1 . . . θ n ω ′ [X], Var (t ′ ) ⊆ X ′ and t ′ ω ′ is in normal form,
which is what we had to prove.

We are now ready to show the correctness of the algorithm:

Theorem 3.2 (Correctness).
If R is a convergent optimally reducing rewrite system, the set

Σ = {σ = θ 1 . . . θ n | (t, Pos init (t), Var (t)) θ1,...,θn ֒→ (t ′ , P ′ , X ′ )}
is a finite strongly complete set of variants of t.

Proof of Theorem 3.2. Let ω 0 be an arbitrary substitution and let ω = ω 0 ↓. We have immediately that tω 0 ↓ = tω↓. We show that there exist a substitution σ ∈ Σ and a substitution τ such that tω 0 ↓ = tω↓ = (tσ)↓τ and ω↓[Var (t)] = στ [Var (t)].

Let P = Pos init (t) and X = Var (t). We have that tω| p is in normal form for every position p ∈ Pos(tω) \ Pos init (t) by the definition of Pos init (every such term tω| p is a subterm of the substitution ω = ω 0 ↓ and therefore it is obviously in normal form). We have furthermore that Var (t) = X ⊆ X. Therefore we can apply Lemma 3.4. We have that there exist n ≥ 0, θ 1 , . . . , θ n , t ′ , ω ′ , P ′ , X ′ such that (t, P, X)

θ1...θn ֒→ (t ′ , P ′ , X ′ ), such that ω[X] = θ 1 . . . θ n ω ′ [X] and such that t ′ ω ′ is in normal form. Let σ = θ 1 . . . θ n and let τ = ω ′ . By Lemma 3.2, we have that tθ 1 . . . θ n → * R t ′ and therefore tθ 1 . . . θ n ω ′ → * R t ′ ω ′ . But θ 1 . . . θ n ω ′ [X] = ω[X]
. As X = Var (t), it follows by Lemma 2.1 that therefore tω = tθ 1 . . . θ n ω ′ . Therefore tω → * R t ′ ω ′ . As t ′ ω ′ is in normal form and R is convergent, it follows that tω↓ = t ′ ω ′ . But tω↓ = tω 0 ↓ and therefore tω 0 ↓ = t ′ ω ′ . Since t ′ ω ′ is in normal form, it follows that t ′ must also be in normal form. As tθ 1 . . . θ n → * R t ′ and σ = θ 1 . . . θ n , we have that tσ↓ = t ′ . Therefore tω 0 ↓ = (tσ)↓ω ′ . But τ = ω ′ and therefore tω 0 ↓ = (tσ↓)τ .

By the choice of σ and τ , we have that ω

[X] = στ [X]. As ω = ω 0 ↓, it follows that ω 0 ↓[X] = στ [X].
We have chosen ω 0 arbitrarily and we have shown that ω 0 [X] = στ [X] and tω 0 ↓ = (tσ↓)τ for some substitution σ ∈ Σ and for some substitution τ . It follows that Σ is a strongly complete set of variants of t.

Each narrowing step θi ֒→ (1 ≤ i ≤ n) is finitely branching (there is at most one narrowing choice for each rewrite rule and each position of the term). Furthermore each narrowing step strictly decreases the number of positions at which narrowing can be performed and therefore the number n of steps ( θ1,...,θn ֒→ ) is finite. We have therefore that Σ is finite and we conclude that Σ is a finite strongly complete set of variants of t.

Equational Unification for Theories Having the SFVP

In this subsection we show that equational theories E implementable by term rewriting systems having the SFVP are finitary, i.e. any two terms s and t have finite complete set of E-unifiers. Our proof is constructive: we give an algorithm that computes a finite complete set of E-unifiers of two terms s and t from the finite strongly complete sets of variants of s and of t.

Indeed, the constructive algorithm follows immediately from the following theorem, which constructs a complete set of equational unifiers of two terms s and t, at most one equational unifier per pair of strong variants of s and of t. Theorem 3.3. Let E be an equational theory and let R be a convergent rewrite system that implements E.

Let s, t ∈ T (F, A) be two terms with common set of variables Var (s) ∩ Var (t) = {x 1 , . . . , x n } and let Variants(s) and Variants(t) be finite, strongly complete sets of variants of the terms s and t with respect to the rewrite system R. Then the set

Σ = { σ s ↓π s σ[Var (s) \ Var (t)] ⊎ σ s ↓π s σ[Var (s) ∩ Var (t)] ⊎ σ t ↓π t σ[Var (t) \ Var (s)] | for all σ s ∈ Variants(s) for all σ t ∈ Variants(t)
where π s is a variable renaming from Var (sσ s ↓) to a fresh set of variables X s where π t is a variable renaming from Var (tσ t ) to a fresh set of variables X t such that X s ∩ X t = ∅ where σ = mgu(tuple(sσ s ↓π s , x 1 σ s ↓π s , . . . , x n σ s ↓π s ), tuple(tσ t ↓π t , x 1 σ t ↓π t , . . . , x n σ t ↓π t )) where tuple is a fresh free function symbol of arity ar(tuple) = n + 1 } is a finite complete set of E-unifiers of s and t.

Before proving the theorem above, we illustrate the construction in the theorem by an example.

Example 3.6. Let s = dec(x, y) and t = dec(z, y). Notice that both terms are decryptions with the same variable y as a key. We are interested in computing a complete set Σ of unifiers of s

? = R t,
σ s = {x → enc(z, y)} z {z → z s } x {x → x t } {z s → x t } {x → enc(x t , y), σ t = {z → enc(x, y)} z → enc(x t , y)} σ s = {} dec(x, y) {x → x s , x {x → x t } {x t → dec(x s , y s ), {x → x s , σ t = {z → enc(x, y)} y → y s } y → y s } y → y s , z → enc( dec(x s , y s ), y s )} σ s = {z → enc(x, y)} x {x → x s } dec(z, y) {z → z t , {x s → dec(z t , y t ), {x → enc( σ t = {} y → y t } y → y t } dec(z t , y t ), y t ) y → y t , z → z t } σ s = {} dec(x, y) {x → x s , dec(z, y) {z → z t , {x s → z t , {x → z t , σ t = {} y → y s } y → y t } y s → y t } y → y t , z → z t }
By the theorem above, we obtain that the set containing the four substitution on the rightmost column of the above table is a complete set of unifiers of s = dec(x, y) and t = dec(z, y).

We are now ready to proceed to the proof of the theorem.

Proof of Theorem 3.3. In order to prove the theorem, we have to show that the set Σ satisfies the following properties:

1. it is finite.

2. it is sound: any ω ∈ Σ is an E-unifier of s and t.

3. it is complete: any E-unifier τ ′ of s and t (sτ ′ = E tτ ′ ) is an instance of some substitution ω ∈ Σ.

We prove that Σ has each of the three properties in turn:

1. Σ is finite. Indeed, there is at most one substitution in Σ for every pair (σ s , σ t ) ∈ Variants(s) × Variants(t) of variants of s and t.

2. Σ is sound, i.e. any substitution ω ∈ Σ is such that sω = E tω.

Let ω ∈ Σ be an arbitrary substitution. As ω ∈ Σ, it follows that there exist substitutions Let π s and π t be the substitutions used in the definition of Σ. Let

σ s ∈ Variants(s), σ t ∈
θ = π -1 s τ s [X s ]⊎π -1 t τ t [X t
]. We will show that θ unifies the term tuple(sσ s ↓π s , x 1 σ s ↓π s , . . . , x n σ s ↓π s ) with the term tuple(tσ t ↓π t , x 1 σ t ↓π t , . . . , x n σ t ↓π t ). Indeed, we have that sσ s ↓π s θ = sσ s ↓π s π -1 s τ s = sσ s ↓τ s = sτ ↓. Similarly, tσ t ↓π t θ = tσ t ↓π t π -1 t τ t = tσ t ↓τ t = tτ ↓. But sτ ↓ = tτ ↓ and therefore sσ s ↓π s θ = tσ t ↓π t θ. This shows that θ unifies the elements on the first position in the two tuples.

For the other elements, let x i ∈ Var (s) ∩ Var (t) = {x 1 , . . . , x n } be an arbitrary variable. We have that x i σ s ↓π s θ = x i σ s ↓π s π -1 s τ s = x i σ s ↓τ s = x i τ ↓. Analogously, x i σ t ↓π t θ = x i τ ↓. Therefore θ unifies the elements on the others positions in the two tuples as well.

As θ unifies tuple(sσ s ↓π s , x 1 σ s ↓π s , . . . , x n σ s ↓π s ) and tuple(tσ t ↓π t , x 1 σ t ↓π t , . . . , x n σ t ↓π t ), it follows that the two terms have a most general unifier σ of which θ is an instance:

θ = σθ ′ . Let γ = θ ′ and let ω = σ s ↓π s σ[Var (s) \ Var (t)] ⊎ σ s ↓π s σ[Var (s) ∩ Var (t)] ⊎ σ t ↓π t σ[Var (t) \ Var (s)].
By the definition of Σ, we have that ω ∈ Σ. We will show that τ ↓[Var (s, t)] = ωγ[Var (s, t)].

Indeed, let x ∈ Var (s) be an arbitrary variable. We have

that xωγ = x(σ s ↓π s σ[Var (s)])θ ′ = xσ s ↓π s σθ ′ = xσ s ↓π s θ = xσ s ↓π s π -1 s τ s = xσ s ↓τ s = xτ ↓. Analogously, if x ∈ Var (t), we have that xωγ = xτ ↓.
As xωγ = xτ ↓ for any x ∈ Var (s) ∪ Var (t), we have that ωγ[Var (s, t)] = E τ [Var (s, t)]. As τ was chosen arbitrarily, it follows that Σ is a complete set of equational unifiers of s and t.

We have shown that Σ is a finite (first item), complete set (third item) of E-unifiers (second item) of s and t. Theorem 3.3 shows that any equational theory that can be implemented by term rewriting system having the strong finite variant property is finitary. Furthermore, it shows how a complete set of unifiers of two terms can be effectively constructed from strongly complete sets of variants of the terms in question. As an immediate corollary, we have that convergent optimally reducing equational theories are finitary and that finite complete sets of unifiers are effectively constructible.

Conclusion and Tool Support

We have created a prototype implementation of the algorithm in Section 3.5 for computing strongly complete sets of variants in the SubVariant tool [START_REF] Ciobâcȃ | [END_REF].

The SubVariant tool is written in OCaml. The goal of the tool is to demonstrate the implementation of the algorithm and it was not designed with efficiency in mind. In particular, the implementation of the algorithm used to compute the most general unifier takes exponential time in the worst case.

The tool receives as input a term rewriting system R and a term t and it computes a finite set of variants of t with respect to the rewrite system R. If the rewrite system is convergent and optimally reducing, the computed set is guaranteed to be a strongly complete set of variants of t. For other convergent rewrite systems (that are not optimally reducing) the set of variants is sound (due to the soundness of the narrowing rule) but it is not in general complete, since the narrowing rule is only guaranteed to be complete when the term rewriting system is optimally reducing.

In addition to computing strongly complete sets of variants, the tool also can also compute sets of unifiers for an equational unification problem. Again, if the underlying rewrite system is optimally reducing, the result is guaranteed to be a complete set of unifiers for the given equation.

In our experiments, the tool SubVariant finished instantaneously on small, hand chosen examples. However, it can be made to take exponential time by using specially crafted examples, since the number of variants of a term can be exponential, as shown in the following example.

Example 3.7. Let t = tuple(dec(x 1 , y 1 ), . . . , dec(x n , y n )) be a term and consider the following subterm convergent rewrite system R = {dec(enc(x, y), y) → x} (R is optimally reducing as well). The symbol tuple is a free symbol of arity n.

In any strongly complete set of variants of t, there must be a variant for every possible choice of success or failure of the decryption operations dec(x i , y i ) (for 1 ≤ i ≤ n). Therefore, any strongly complete set of variants of t will have size at least 2 n . The equational unification algorithm for two terms s and t will create a complete set of unifiers that is of size at most |Variants(s)| × |Variants(t)|, since at most an equational unifier is added for each pair of strong variants of s and t. Therefore, the equational unification algorithm will introduce at most a quadratic blow-up compared to the algorithm for finding strongly complete set of variants.

In general, there is no guarantee that the strongly complete set of variants computed by the algorithm in Section 3.5 is minimal in the sense that any strict subset of it is not strongly complete. However, it is easy to obtain minimal strongly complete sets of variants by a post-processing step that removes redundant variants.

Similarly, there is no guarantee that the complete set of equational unifiers found by the algorithm in Section 3.6 is minimal but can be rendered minimal by a post-processing step.

As future work, it would be interesting to study the notion of SFVP in the presence of an equational theory such as AC, to obtain algorithms for finding strongly complete sets of variants and complete sets of unifiers modulo such a theory and to apply these algorithms in the verification of security protocols.

Chapter 4

A Decision Procedure for Static Equivalence

Introduction

We have seen in Chapter 1 that cryptographic protocols are small distributed programs that make use of cryptographic primitives such as encryption and digital signatures to communicate securely over a network. We have also shown that it is essential to gain as much confidence as possible in their security because insecurity can have important negative consequences.

Symbolic methods have been developed to analyze such protocols [12,[START_REF] Millen | Constraint solving for bounded-process cryptographic protocol analysis[END_REF][START_REF] Rusinowitch | Protocol insecurity with finite number of sessions and composed keys is NP-complete[END_REF]. In these approaches, one of the most important aspects is to be able to reason about the knowledge of the attacker. Traditionally, the knowledge of the attacker is expressed in terms of deducibility (e.g. [START_REF] Rusinowitch | Protocol insecurity with finite number of sessions and composed keys is NP-complete[END_REF][START_REF] Chevalier | Résolution de problèmes d' accessibilité pour la compilation et la validation de protocoles cryptographiques[END_REF]). A message s (intuitively the secret) is said to be deducible from a set of messages ϕ, if an attacker is able to compute s from ϕ. To perform this computation, the attacker is allowed, for example, to decrypt deducible messages by deducible keys.

However, deducibility is not always sufficient. Consider for example the case where a protocol participant sends over the network the encryption of one of the constants "yes" or "no" (e.g. the value of a vote). Deducibility is not the right notion of knowledge in this case, since both possible values ("yes" and "no") are indeed "known" to the attacker. In this case, a more adequate form of knowledge is indistinguishability (e.g. [2]): is the attacker able to distinguish between two transcripts of the protocol, one running with the value "yes" and the other one running with the value "no"?

Related Work

Many decision procedures have been proposed for deducibility (e.g. [START_REF] Chevalier | Résolution de problèmes d' accessibilité pour la compilation et la validation de protocoles cryptographiques[END_REF]8,[START_REF] Lafourcade | Intruder deduction for the equational theory of abelian groups with distributive encryption[END_REF][START_REF] Chevalier | Key substitution in the symbolic analysis of cryptographic protocols[END_REF]) under a variety of equational theories modelling encryption, digital signatures, exclusive or, and homomorphic operators. Several papers are also devoted to the study of static equivalence. Most of these results introduce a new procedure for each particular theory and even in the case of the general decidability criterion given in [2,[START_REF] Cortier | Deciding knowledge in security protocols for monoidal equational theories[END_REF], the algorithm underlying the proof has to be adapted for each particular theory, depending on how the criterion is fulfilled. A combination result was obtained in [START_REF] Arnaud | Combining algorithms for deciding knowledge in security protocols[END_REF]: if deduction and static equivalence are decidable for two disjoint equational theories, then deduction and static equivalence are also decidable for the union of the two theories.

The first generic algorithm that has been proposed handles subterm convergent equational theories [2] and covers the classical theories for encryption and signatures. This result is encompassed by the recent work of Baudet et al. [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF][START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF] in which the authors propose a generic procedure that works for any convergent equational theory, but which may fail or not terminate. This procedure has been implemented in the YAPA tool [START_REF] Baudet | YAPA (Yet Another Protocol Analyzer)[END_REF] and has been shown to terminate without failure in several cases (e.g. subterm convergent theories and blind signatures). However, due to its simple representation of deducible terms (represented by a finite set of ground terms), the procedure fails on several interesting equational theories like the theory of trapdoor commitments. Our representation of deducible terms overcomes this limitation by including terms with variables which can be substituted by any deducible terms. Independently of our work, specific decision procedures for the theory of trapdoor commitment and that of reencryption have been presented in [START_REF] Berrima | Deciding knowledge in security protocols under some e-voting theories[END_REF], but have not been implemented.

Another tool that can be used to check static equivalence is ProVerif [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF][START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF], although this tool is overkill in the sense that it was designed to handle a more general problem: observational equivalence of two processes. ProVerif can handle various equational theories and analyze security protocols under active adversaries but termination is not guaranteed in general and the tool performs safe approximations.

Contribution

In this chapter, we present a decision procedure for checking static equivalence under certain equational theories. Static equivalence models indistinguishability of two sequences of messages. Intuitively, this notion does not take into account the dynamic behavior of the protocol. Nevertheless, in order to establish that two dynamic behaviors of a protocol are indistinguishable, an important subproblem is to establish indistinguishability between the sequences of messages generated by the protocol [START_REF] Rusinowitch | Protocol insecurity with finite number of sessions and composed keys is NP-complete[END_REF]3]. We will come back to the dynamic behavior of protocols in Chapter 5.

Static equivalence also plays an important role in the study of guessing attacks (e.g. [START_REF] Corin | Analysing password protocol security against off-line dictionary attacks[END_REF][START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF]), as well as for anonymity properties in e-voting protocols (e.g. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF][START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF]). This was actually the starting point of this work. During the study of e-voting protocols, we came across several equational theories for which we needed to show static equivalence while no decision procedure for deduction or static equivalence existed.

Our procedure is based on modeling the frames into first-order Horn clauses which we describe in Section 4.2. We then present a saturation strategy (Section 4.3) for the set of Horn clauses such that static equivalence of two frames can easily be checked from the saturated sets of Horn. We prove that the saturation process is sound and complete in Section 4.4. We show how to decide static equivalence and the intruder deduction problem from the saturated knowledge base(s) in Section 4.5.

Both static equivalence and the intruder deduction problem are undecidable, even when the equational theory is convergent [2]. Therefore, our saturation procedure does not always terminate. In Section 4.6, we illustrate examples of non-termination and we identify several useful (classes of) equational theories where it does terminate.

As a byproduct we obtain an algorithm for the intruder deduction problem, namely the problem of deciding if a message can be computed by the intruder from a given set of messages.

This chapter is based on work that has been published [START_REF] Ciobâcȃ | Computing knowledge in security protocols under convergent equational theories[END_REF][START_REF] Ciobâcȃ | Computing knowledge in security protocols under convergent equational theories[END_REF]. The algorithms described here have been implemented in the tool KiSs [45] that we discuss in Section 4.7. We conclude and present possible future work in Section 4.8

Our method extends previous work [2] most notably by providing a decision procedure for an equational theory modeling trap-door commitment. This equational theory is particularly relevant to voting protocols, where it is used to provide forms of coercion-resistance [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. However, none of the previous work provided a decision procedure for static equivalence in the case of this equational theory.

Example 4.1. As a running example for this section we will consider the rewrite system

R mal = { dec(enc(x, y), y) → x mal(enc(x, y), z) → enc(z, y)},
modeling a hypothetical malleable encryption algorithm that allows one to obtain via the mal function symbol the encryption of any known term with an unknown key, as long as a prior encryption with that key is available. While such an encryption algorithm would be too far-fetched to be used in practice, this rewrite system allows us to illustrate our procedure. In particular, the theory cannot be handled by current procedures [START_REF] Baudet | YAPA (Yet Another Protocol Analyzer)[END_REF], but it is simple to present and it presents the same issue as more practical theories such as trapdoor commitment.

We will consider the frame ϕ 1 = {w 1 → enc(a, k)}, where a, k ∈ N are private names and the frame ϕ 2 = {w 1 → enc(b, k)} where b ∈ M is a public name. The two frames represent two runs of a protocol: in the first run, the protocol outputs on the network the encryption of a private name a with a private key k and in the second run the protocol outputs the encryption of a public name b with the private key k. The intruder can tell the difference between the two runs as follows:

1. apply the function symbol mal to the parameter w 1 (which will "evaluate" to enc(a, k) or to enc(b, k), depending on the run) and to the term b (in the first run, the resulting term will be mal(enc

(a, k), b) = R mal enc(b, k) and in the second run mal(enc(b, k), b) = R mal enc(b, k)),
2. compare the resulting term to w 1 : if they are equal then we are in the second run; otherwise in the first.

The fact that the intruder can tell the difference between the two frames is because the two frames are not statically equivalent. This follows because mal(w

1 , b) = w 1 is a test that holds in ϕ 2 ((mal(w 1 , b) = w 1 )ϕ 2 ) but not in ϕ 1 ((mal(w 1 , b) = w 1 )ϕ 1 ).
Note that the above inequivalence is due to the choice of the rewrite system. Had we chosen to compare the two frames ϕ 1 and ϕ 2 with respect to the classical rewrite system R = {dec(enc(x, y), y) → x}, we would have found that ϕ 1 is statically equivalent to ϕ 2 . The fact that the two frames are not statically equivalent with respect to R mal is due to the additional power given to the intruder by the mal function symbol.

Modeling Frames as Sets of Horn Clauses

As we have already announced, our procedure is based on a modeling of frames into first order Horn clauses. A refinement of resolution described in Section 4.3 is then applied to the set of Horn clauses in order to obtain an equivalent saturated set of Horn clauses that we called solved. The set of solved Horn clauses is equivalent in a sense made precise by Theorem 4.1 to the initial set of Horn clauses. However, starting from the solved clauses associated to two frames, it is easy to decide static equivalence as shown in Section 4.5. In order to obtain termination of the saturation procedure (shown in Section 4.6), our refinement of resolution makes heavy use of the form of redundancy elimination described in Section 4.3.

We now show how we model frames as first order Horn clauses.

Predicates. To construct the Horn clauses, we consider the usual first-order logic connectives, with two additional binary predicates, k and i. The k(R, t) predicate intuitively denotes that R is a recipe for t while the i(R, R ′ ) predicate intuitively denotes that R and R ′ are recipes for the same term. We say that a substitution σ is well-formed with respect to a formula if tσ does not contain any parameter w i ∈ W for any term t appearing as the second argument of a k predicate in the formula and if Rσ does not contain any private name n ∈ N for any term R appearing as the first argument of a k predicate or as an argument of the i predicate. A formula is well-formed if the identity substitution is well-formed with respect to the formula.

Well-formed first-order formulas are interpreted over frames ϕ and well-formed valuations σ. (i.e. well-formed substitutions associating a ground term to each free variable in the formula).

The semantics of the two predicates for ground arguments is given in Figure 4.1. The semantics of the first-order connectives ∧, ∨, ¬ are defined as usual. The semantics of the quantifiers is defined as usual, but restricting the domain of the variables such that the resulting valuation is well-formed. A well-formed formula is valid in a frame if it is true when interpreted over all well-formed valuations. From hereon, we will assume that all formulas are well-formed.

Predicates: The "intruder knowledge predicate" k(R, t) intuitively states that R is a recipe for t in the frame ϕ and the "intruder identity predicate" i(R, R ′ ) intuitively states that R = R ′ is an identity that holds in the frame ϕ (i.e. (R = R ′ )ϕ).

k(R, t) (intruder Knowledge predicate) i(R, R ′ ) (intruder Identity predicate) Semantics: ϕ |= k(R, t) if ϕ ⊢ R t ϕ |= i(R, R ′ ) if (R = R ′ )ϕ
Example 4.2. Continuing the previous example, the ground formula k(w 1 , enc(a, k)) is true in the frame ϕ 1 but not in the frame ϕ 2 . The formula k(b, b) is true in both frames, since b is a public name and is recipe of itself in any frame. The formula k(a, a) is not well-formed since a is a private name and it appears as a first argument of the k predicate.

The formula ∀X, Y.(k(mal(X, Y ), mal(x, y)) ⇐ k(X, x) ∧ k(Y, y))
is true in all frames (The symbol "⇐" denotes implication) since if X is a recipe for x and Y is a recipe of y then mal(X, Y ) will be a recipe for mal(x, y).

The formula i(w 1 , mal(w 1 , b)) is true in ϕ 2 but not in ϕ 1 (this is the reason that the two frames are not statically equivalent). The formula i(w 1 , mal(w 1 , a)) is not well-formed since the private name a appears in one of the arguments of the i predicate.

Statements. Our algorithm works with a particular class of Horn clauses that we call statements.

f = k(R, t) ⇐ k(X 1 , t 1 ), . . . , k(X n , t n ) or f = i(R, R ′ ) ⇐ k(X 1 , t 1 ), . . . , k(X n , t n ) such that: 1. Var (R, R ′ , X 1 , . . . , X n ) ∩ Var (t, t 1 , . . . , t n ) = ∅, 2. Var (t) ⊆ Var (t 1 , . . . , t n ) and 3. X 1 , . . . , X n are distinct variables.
In the first case in the above definition, we call f a deduction statement and in the second case we call f an identity statement or an equational statement. We say that a statement is solved if

t i ∈ X for all 1 ≤ i ≤ n.
A statement is well-formed if it is not a deduction statement, or if it is a deduction statement that is not solved, or if it is a deduction statement that is solved and t ∈ X . In other words, a statement is not well-formed only if it is a solved deduction statement with t ∈ X being a variable.

As statements are Horn clauses, we identify them up to bijective renaming of variables and up to permutation of the antecedents. In inferences rules that use statements, we assume as expected that the variables in the statements are renamed to fresh variables.

Example 4.3. The statement k(w 1 , enc(a, k)) ⇐ (a Horn clause with an empty body) is true in

ϕ 1 but not in ϕ 2 . The statement i(w 1 , X) ⇐ k(X, enc(b, k)) is true in ϕ 2 but not in ϕ 1 . The statement i(X, Y ) ⇐ k(X, x), k(Y, x) is true of all frames.

Saturation Procedure

Derivable statements. Let K be a set of statements and t, R be terms. Definition 4.2. We say that the predicate k(R, t) is derivable from K (and we write k(R, t) ∈ deriv(K)) if:

1. either t and R are the same variable (t = R and t ∈ X)

2. or there exist a statement f = k(R 0 , t 0 ) ⇐ k(X 1 , t 1 ), . . . , k(X n , t n ) ∈ K, some terms R 1 , . . . , R n and a substitution σ with Dom(σ) ⊆ Var (t 0 ) such that t = t 0 σ, R = R 0 {X i → R i } 1≤i≤n and k(R i , t i σ) ∈ deriv(K) for 1 ≤ i ≤ n.
If K is a set of well-formed solved statements, there is a simple recursive algorithm that, given K and t, tests if there exists a term R such that k(R, t) ∈ deriv(K) and constructs such an R if it exists. Termination is ensured by the fact that |t i σ| < |t| for all 1 ≤ i ≤ n. Note that using memoization the algorithm works in polynomial time.

k(w 1 , enc(b, k)) ⇐ (f 1 ) k(b, b) ⇐ (f 2 ) k(enc(Y 1 , Y 2 ), enc(y 1 , y 2 )) ⇐ k(Y 1 , y 1 ), k(Y 2 , y 2 ) (f 3 )
We have that k(enc(w 1 , b), enc(enc(b, k), b)) is derivable from K. This follows easily by instantiating the two antecedents of f 3 with f 1 and f 2 , respectively.

Equational consequences. Given a finite set K of solved equational statements and terms M, N , we write

K |= i(M, N ) if i(M, N
) is a consequence, in the usual first order theory of equality (for the binary symbol i) of

{i(Rσ, R ′ σ) | i(R, R ′ ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) ∈ K} where σ = {X i → x i } 1≤i≤k .
Note that it may be the case that x i = x j for some i = j (whereas X i = X j whenever i = j by the definition of a statement).

Canonical form. We define for each statement f its canonical form f ⇓, obtained by first applying Rule Rename as much as possible and then Rule Remove as much as possible. The idea is to ensure that each variable x i occurs at most once in the body and to get rid of those variables that do not occur in t. This will be particularly useful to characterize the form of solved statements when we prove termination of the saturation procedure. Unsolved statements and equational statements are kept unchanged by canonicalization.

Rename

k(R, t) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) {i, j} ⊆ {1, . . . , n} j = i and x j = x i k(R{X i → X j }, t) ⇐ k(X 1 , x 1 ), . . . , k(X i-1 , x i-1 ), k(X i+1 , x i+1 ), . . . , k(X k , x k ) Remove k(R, t) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) x i ∈ Var (t) k(R, t) ⇐ k(X 1 , x 1 ), . . . , k(X i-1 , x i-1 ), k(X i+1 , x i+1 ), . . . , k(X k , x k ) Example 4.5. Consider the statement f = k(dec(enc(X 1 , X 2 ), X 3 ), x 1 ) ⇐ k(X 1 , x 1 ), k(X 2 , y), k(X 3 , y) .
To find the canonical form f ⇓ of f , we start by applying Rule Rename, after which we obtain the statement:

k(dec(enc(X 1 , X 2 ), X 2 ), x 1 ) ⇐ k(X 1 , x 1 ), k(X 2 , y) .
We continue with the application of Rule Remove, after which we obtain the canonical form:

f ⇓ = k(dec(enc(X 1 , X 2 ), X 2 ), x 1 ) ⇐ k(X 1 , x 1 ) .
Note that it is important that Rule Remove is applied only after all instances of Rule Rename where treated. Otherwise, if a variable x i = x j does not appear in the head of the statement, the fact that the recipes X i and X j must be recipes for the same term would be lost and therefore we would make an unsound inference.

Update. We group statements into knowledge bases. Definition 4.3. A knowledge base is a set K set of well-formed statements in canonical form.

When adding a statement to a knowledge base, we perform some redundancy checks. The redundancy checks are performed through the update function.

Definition 4.4 (update). Given a deduction statement f = k(R, t) ⇐ k(X 1 , t 1 ), . . . , k(X n , t n ) and a knowledge base K, the update of K by f , written K ⊕ f , is defined as:

                 K ∪ {f ⇓} if f is solved and k(R, t) ∈ deriv(K) useful statement for any R K ∪ i(R ′ , Rσ) ⇐ ∅ if f is solved and R ′ is such that redundant statement k(R ′ , t) ∈ deriv(K) and σ = {X 1 → t 1 , . . . , X n → t n } (K ∪ {f }) if f is not solved unsolved statement
Given an equational statement f and a knowledge base K, the update

K ⊕ f of K by f is simply K ∪ {f }.
The choice of the recipe R ′ in the redundant statement case is defined by the implementation. While this choice does not influence the correctness of the saturation procedure, it might influence its termination as we will see later.

Note that the result of updating a knowledge base by a (possibly not well-formed and/or not canonical) statement is again a knowledge base. Statements that are not well-formed will be captured by the redundant statement case, which adds an equational statement instead.

The role of the update function is to add statements to the knowledge base, while performing some redundancy elimination. If k(R, t) ∈ deriv(K) for any R, then the statement to be added clearly provides interesting information and it is added to the knowledge base.

If the statement to be added is unsolved, it is added anyway (because it might prove useful later on).

If the statement to be added is solved and k(R, t) ∈ deriv(K) for some R, then this deduction statement does not provide new information about deducible terms, but it might provide a new recipe for terms we already know deducible. Therefore, an equational statement is added instead, stating that the two recipes are equal provided the antecedents are satisfied.

Example 4.6. We consider the knowledge base K containing the following statements:

k(w 1 , enc(b, k)) ⇐ (f 1 ) k(b, b) ⇐ (f 2 ) k(enc(Y 1 , Y 2 ), enc(y 1 , y 2 )) ⇐ k(Y 1 , y 1 ), k(Y 2 , y 2 ) (f 3 )
We

R ′ = enc(w 1 , b)). However, a new equational statement i(w 2 , enc(w 1 , b)) ⇐ would be added instead.
Initialisation. Given a frame ϕ = {w 1 → t 1 , . . . , w n → t n }, our procedure starts from an initial knowledge base associated to ϕ and defined as follows:

K i (ϕ) = ∅ 1≤i≤n k(w i , t i ) ⇐ n∈(N ames(ϕ)∩M) k(n, n) ⇐ f ∈F k(f (X 1 , . . . , X k ), f (x 1 , . . . , x k )) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k )
where k = ar(f ) is the arity of f Example 4.7. We will continue with the frames ϕ 1 = {w 1 → enc(a, k)}, where a ∈ N is a private name and ϕ 2 = {w 1 → enc(b, k)} with k ∈ N being a private name and b ∈ M being a public name defined in the previous examples. The knowledge base K i (ϕ 2 ) is the following set of statements:

k(w 1 , enc(b, k)) ⇐ (f 1 ) k(b, b) ⇐ (f 2 ) k(enc(Y 1 , Y 2 ), enc(y 1 , y 2 )) ⇐ k(Y 1 , y 1 ), k(Y 2 , y 2 ) (f 3 ) k(dec(Y 1 , Y 2 ), dec(y 1 , y 2 )) ⇐ k(Y 1 , y 1 ), k(Y 2 , y 2 ) (f 4 ) k(mal(Y 1 , Y 2 ), mal(y 1 , y 2 )) ⇐ k(Y 1 , y 1 ), k(Y 2 , y 2 ) (f 5 )
Saturation. The idea of the saturation procedure is to keep adding valid statements to the knowledge base such as to produce:

1. a set of solved deduction statements which have the same set of syntactic consequences as the initial set of deduction statements modulo the equational theory and 2. a set of solved equational statements whose consequences are exactly the equations holding in the frame.

The main part of this procedure consists in saturating the initial knowledge base K i (ϕ) by means of the transformation rules described in Figure 4.2.

Narrowing

f = k(M, C[t]) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) ∈ K l → r ∈ R, t ∈ X , σ = mgu(l, t) and Var (f ) ∩ Var (l) = ∅. K =⇒ K ⊕ f 0 where f 0 = k(M, (C[r])σ) ⇐ k(X 1 , x 1 )σ, . . . , k(X k , x k )σ .

F-Solving

f 1 = k(M, t) ⇐ k(X, u), k(X 1 , t 1 ), . . . , k(X k , t k ) ∈ K f 2 = k(N, s) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ , y ℓ ) ∈ K with u ∈ X , σ = mgu(s, u) and Var (f 1 ) ∩ Var (f 2 ) = ∅. K =⇒ K ⊕ f 0 where f 0 = k(M {X → N }, tσ) ⇐ {k(X i , t i σ)} 1≤i≤k ∪ {k(Y i , y i σ)} 1≤i≤ℓ .
Unifying

f 1 = k(M, t) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) ∈ K f 2 = k(N, s) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ , y ℓ ) ∈ K with σ = mgu(s, t) and Var (f 1 ) ∩ Var (f 2 ) = ∅. K =⇒ K ∪ {f 0 } where f 0 = i(M, N ) ⇐ {k(X i , x i σ)} 1≤i≤k ∪ {k(Y i , y i σ)} 1≤i≤ℓ . E-Solving f 1 = i(U, V ) ⇐ k(Y, s), k(X 1 , t 1 ), . . . , k(X k , t k ) ∈ K f 2 = k(M, t) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ , y ℓ )} ∈ K with s ∈ X , σ = mgu(s, t) and Var (f 1 ) ∩ Var (f 2 ) = ∅. K =⇒ K ∪ {f 0 } where f 0 = i(U {Y → M }, V {Y → M }) ⇐ {k(X i , t i σ)} 1≤i≤k ∪ {k(Y i , y i σ)} 1≤i≤ℓ .

Figure 4.2: Saturation rules

The rule Narrowing is designed to apply a rewriting step on an existing deduction statement. Intuitively, this rule allows us to get rid of the equational theory and nevertheless ensures that the set of derivable predicates remains complete. This rule might introduce unsolved antecedents in the statement. The rule F-Solving is then used to instantiate the unsolved antecedents of an existing deduction statement. Unifying and E-Solving add equational statements which memorize when different recipes for the same term exist.

Note that this procedure may not terminate and that the fixed point may not be unique (the order in which new statements are added by the ⊕ operation matters).

We write =⇒ * for the reflexive and transitive closure of =⇒.

Example 4.8. Continuing Example 4.7, we illustrate the saturation procedure. We can apply the rule Narrowing on the statement f 4 and the rewrite rule dec(enc(x, y), y) → x, as well as on the statement f 5 and the rewrite rule mal(enc(x, y), z) → enc(z, y), thereby adding the statements:

k(dec(Y 1 , Y 2 ), x) ⇐ k(Y 1 , enc(x, y)), k(Y 2 , y) (f 6 ) k(mal(Y 1 , Y 2 ), enc(z, y)) ⇐ k(Y 1 , enc(x, y)), k(Y 2 , z) (f 7 )
The statements f 6 and f 7 are not solved and we can apply the rule F-Solving with f 1 , adding the statements:

k(dec(w 1 , Y 2 ), b) ⇐ k(Y 2 , k) (f 8 ) k(mal(w 1 , Y 2 ), enc(z, k)) ⇐ k(Y 2 , z) (f 9 )
Rule Unifying can be used on statements f 1 /f 3 , f 3 /f 9 as well as f 1 /f 9 to add equational statements. This third case allows one to obtain

f 10 = i(w 1 , mal(w 1 , Y 2 )) ⇐ k(Y 2 , b)
which can be solved (using E-Solving with f 2 ) to obtain

f 11 = i(w 1 , mal(w 1 , b)) ⇐ , etc.
When reaching a fixed point, f 9 , f 11 and the statements in Init(ϕ 2 ) are some of the solved statements contained in the knowledge base.

Soundness and Completeness

In this section we prove the soundness and completeness of the saturation procedure:

Theorem 4.1. Let ϕ be a frame and K be a saturated knowledge base such that Init(ϕ) =⇒ * K.

Let t ∈ T (F) and let

K + = K ∪ { k(n, n) ⇐ | n ∈ N ames(t) \ N }. Then 1.
for all terms M we have that:

ϕ ⊢ M t iff there exists N such that K| solved |= i(M, N ) and k(N, t↓) ∈ deriv(K + | solved )
2. and for all terms M, N we have that

(M = N )ϕ iff K| solved |= i(M, N ).
We begin by showing the soundness of the saturation procedure.

Soundness

We first show that the update operator (⊕) is sound:

Lemma 4.1.
Let ϕ be a frame and K be a knowledge base such that every statement in K holds in ϕ. Let f 0 be a statement that holds in ϕ. Then every statement in K ⊕ f 0 holds in ϕ.

Proof. We immediately have that if f holds in ϕ, then f ⇓ holds in ϕ. Therefore, if we are in the useful fact or unsolved fact cases, the lemma obviously holds. We also have that if k(R, t) ∈ deriv(K), then k(R, t) is valid in ϕ. Therefore, in the redundant statement case, we have that R ′ and Rσ are recipes for the same term t. Therefore, i(R ′ , Rσ) is also valid in ϕ.

Next we show that any statement in a knowledge base obtained by saturating the initial knowledge base holds in the frame. Lemma 4.2. Let ϕ be a frame and K be a knowledge base such that Init(ϕ) =⇒ * K. Then every statement f ∈ K holds in ϕ.

Proof. By induction on the derivation Init(ϕ) =⇒ * K.

Base case: We have that K = Init(ϕ). To conclude, we have to show that the statements that are added to the initial knowledge base hold in ϕ.

There are three kind of deduction statements that can be added to the knowledge base: the statements that come from ϕ, those of the form k(n, n) ⇐ for n ∈ N ames(ϕ) \ N and those of the form:

k(f (X 1 , . . . , X k ), f (x 1 , . . . , x k )) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) .
It is easy to see that all these statements hold in ϕ and we can conclude by Lemma 4.1.

Induction step:

In such a case, we have Init(ϕ) =⇒ * K ′ =⇒ K. We perform a case analysis on the inference rule used in K ′ =⇒ K. For each rule, we show that the resulting statements f 0 holds in ϕ and we conclude by relying on Lemma 4.1.

Rule Narrowing: Let f = k(M, C[t]) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k )
be the deduction statement, l → r ∈ R be the rewrite rule and σ = mgu(l, t) be the substitution involved in this step. Let

f 0 = k(M, (C[r])σ) ⇐ k(X 1 , x 1 σ), . . . , k(X k , x k σ) be the resulting deduction statement.
We show that f 0 holds in ϕ. Let τ be a substitution such that ϕ

⊢ Mi x i στ for 1 ≤ i ≤ k. Since f holds in ϕ, we have that ϕ ⊢ M ′ (C[t])στ for M ′ = M {X 1 → M 1 , . . . , X k → M k }.
It is easy to see that the following equalities are satisfied:

(C[t])στ = (C[l])στ = R (C[r])στ Therefore ϕ ⊢ M ′ (C[r])στ , and thus f 0 holds in ϕ. Rule F-Solving: Let f 1 = k(M, t) ⇐ k(X 0 , t 0 ), . . . , k(X k , t k ) with t 0 ∈ X and f 2 = k(N, s) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ ,
y ℓ ) be the two deduction statements and σ = mgu(s, t 0 ) be the substitution involved in this step. Let f 0 be the resulting deduction statement:

f 0 = k(M {X 0 → N }, tσ) ⇐ k(X 1 , t 1 σ), . . . , k(X k , t k σ), k(Y 1 , y 1 σ), . . . , k(Y ℓ , y ℓ σ) .
We show that f 0 holds in ϕ. Let τ be a substitution such that ϕ ⊢ Mi t i στ for 1 ≤ i ≤ k and ϕ ⊢ Nj y j στ for 1 ≤ j ≤ ℓ). Since f 2 holds in ϕ, we have that ϕ ⊢ N ′ sστ where

N ′ = N {Y 1 → N 1 , . . . , Y ℓ → N ℓ }.
Since f 1 holds in ϕ and sστ = t 0 στ , we deduce that ϕ ⊢ M ′′ tστ where

M ′′ = M {X 0 → N ′ , X 1 → M 1 , . . . , X k → M k } = (M {X 0 → N }){X 1 → M 1 , . . . , X k → M k , Y 1 → N 1 , . . . , Y ℓ → N ℓ }.
This allows us to conclude that f 0 holds in ϕ.

Rule Unifying: Let the statement

f 1 = k(M, t) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) and the statement f 2 = k(N, s) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ ,
y ℓ ) be the two solved deduction statements and σ = mgu(s, t) be the substitution involved in this step Let f 0 be the resulting equational statement:

f 0 = i(M, N ) ⇐ k(X 1 , x 1 σ), . . . , k(X k , x k σ), k(Y 1 , y 1 σ), . . . , k(Y ℓ , y ℓ σ)].
We show that f 0 holds in ϕ. Let τ be a substitution such that ϕ ⊢ Mi x i στ for all 1 ≤ i ≤ k and ϕ ⊢ Nj y j στ for all 1 ≤ j ≤ ℓ. Since f 1 and f 2 hold in ϕ and sστ = tστ , we deduce that ϕ

⊢ M ′ tστ for M ′ ∈ {M {X 1 → M 1 , . . . , X k → M k }, N {Y 1 → N 1 , . . . , Y k → N ℓ }. This allows us to conclude that f 0 holds in ϕ. Rule E-Solving: Let f 1 = i(U, V ) ⇐ k(Y, s), k(X 1 , t 1 ), . . . , k(X k , t k ) be the equational state- ment and f 2 = i(N, t) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ ,
y ℓ ) be the solved deduction statement, and σ = mgu(s, t) be the substitution involved in this step. Let f 0 be the resulting equational statement:

f 0 = i(U {Y → N }, V {Y → N }) ⇐ k(X 1 , t 1 σ), . . . , k(X k , t k σ), k(Y 1 , y 1 σ), . . . , k(Y ℓ , y ℓ σ) .
We show that f 0 holds in ϕ. Let τ be a substitution such that ϕ ⊢ Mi t i στ for all 1 ≤ i ≤ k and ϕ ⊢ Nj y j στ for all 1 ≤ j ≤ ℓ. Since f 2 holds in ϕ, we deduce that ϕ ⊢ N ′ tστ for

N ′ = N {Y 1 → N 1 , . . . , Y ℓ → N ℓ }.
Since sστ = tστ , we deduce that ϕ ⊢ N ′ sστ , and by using the fact that f 1 holds in ϕ we deduce that

(U {Y → N ′ , X 1 → M 1 , . . . , X k → M k } = V {Y → N ′ , X 1 → M 1 , . . . , X k → M k })ϕ.
Thus, f 0 holds in ϕ.

Finally, we are ready to present the main soundness lemma: Lemma 4.3 (soundness). Let ϕ be a frame and K be a knowledge base such that Init(ϕ) =⇒ * K. Let t, M, N be terms and let

K + = K ∪ { k(n, n) ⇐ | n ∈ N ames(t) \ N }. We have that: 1. k(M, t) ∈ deriv(K + ) implies ϕ ⊢ M t and 2. K |= i(M, N ) implies (M = N )ϕ.

Proof. By Lemma 4.2 and because every

f ∈ { k(n, n) ⇐ | n ∈ N ames(t) \ N } holds in ϕ, we
have that all facts in K + hold in ϕ. To conclude, we show Points 1 and 2 stated in the Lemma.

1. Let M and t be such that k(M, t) ∈ deriv(K + ). By definition of deriv, as t is ground, there exists a solved deduction statement

f 0 = k(M 0 , t 0 ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) ∈ K + such that t = t 0 σ for some substitution σ and k(M i , x i σ) ∈ deriv(K + ) for some M i for all 1 ≤ i ≤ k and M = M 0 {X 1 → M 1 , . . . , X k → M k }.
We show the result by induction on |t|.

Base case: |t| = 1. In such a case t is either a name or a constant. We have that k = 0, t 0 = t and M = M 0 . Since f 0 holds in ϕ, we deduce that ϕ ⊢ M0 t. This allows us to conclude.

Induction step. Note that |x i σ| < |t| and k(M i , x i σ) ∈ deriv(K + ), thus we can apply our induction hypothesis on x i σ. We deduce that ϕ ⊢ Mi x i σ and thus ϕ ⊢ M t 0 σ = t since f 0 holds in ϕ.

2. Let M and N be such that K |= i(M, N ). To show that (M = N )ϕ, it is sufficient to establish that

(M ′ σ = N ′ σ)ϕ where σ = {X 1 → x 1 , . . . , X k → x k } for every solved equational fact i(M ′ , N ′ ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) ∈ K.
This follows easily from Lemma 4.2.

Completeness

Let us now prove the completeness of the saturation procedure. First we show completeness with respect to equational statements.

Lemma 4.4. Let K be a saturated knowledge base and

f = i(U, V ) ⇐ k(X 1 , t 1 ), . . . , k(X k , t k )
be an equational statement in K. For any substitution σ grounding for {t 1 , . . . ,

t k } such that k(R ′ i , t i σ) ∈ deriv(K| solved ) for some R ′ i for all 1 ≤ i ≤ k, we have that k(R i , t i σ) ∈ deriv(K| solved ) for some R i for all 1 ≤ i ≤ k and K| solved |= i(U τ, V τ ) where τ = {X 1 → R 1 , . . . , X k → R k }.
Proof. We show this result by induction on k i=1 |t i σ|. We distinguish two cases:

1. f is a solved equational statement, i.e. t 1 , . . . , t k are variables (not necessarily distinct), say

x 1 , . . . , x k . In such a case, we have that

K| solved |= i(U {X 1 → x 1 , . . . , X k → x k }, V {X 1 → x 1 , . . . , X k → x k }).
We choose each R i arbitrarily such that

x i = x j implies R i = R j .
Then, it is easy to conclude.

2. f is an unsolved equational statement. In such a case, there exists t j such that t j ∈ X .

Let us assume w.l.o.g. that j = 1. As k(R ′ 1 , t 1 σ) ∈ deriv(K| solved ), we know that there exist a solved deduction statement

f 1 = k(R 1 , t 1 ) ⇐ k(X 1 1 , x 1 1 ), . . . , k(X 1 ℓ , x 1 ℓ ) in K and a substitution τ such that t 1 τ = t 1 σ and k(R ′ i , x 1 i τ ) ∈ K| solved for all 1 ≤ i ≤ ℓ. Let ρ = mgu(t 1 , t 1 ). Since K is saturated, by rule E-Solving , we have that the following statement f 2 is in K: i(U {X 1 → R 1 }, V {X 1 → R 1 }) ⇐ k(X 1 1 , x 1 1 ρ), . . . , k(X 1 ℓ , x 1 ℓ ρ), k(X 2 , t 2 ρ), . . . , k(X k , t k ρ) .
Let σ ′ be the substitution such that σ ∪ τ = ρσ ′ . As the deduction statement f 1 is solved,

x 1 1 ρσ ′ , . . . , x 1 ℓ ρσ ′ are strict subterms of t 1 ρσ ′ = t 1 τ and ℓ i=1 |x 1 i ρσ ′ | < |t 1 τ | = |t 1 σ|.
Thus we can apply our induction hypothesis on the equational statement f 2 with the substitution σ ′ . This allows us to obtain that there exist

M 1 1 , . . . , M 1 ℓ , M 2 , . . . , M k such that k(M i , t i ρσ ′ = t i σ) ∈ deriv(K| solved ) for all 2 ≤ i ≤ k and k(M 1 i , x 1 i ρσ = x 1 σ) for all 1 ≤ i ≤ ℓ and the following equation (⋆) K| solved |= (i(U {X 1 → R 1 }){X 1 1 → M 1 1 , . . . , X 1 ℓ → M 1 ℓ , X 2 → M 2 , . . . , X k → M k }, (V {X 1 → R 1 }){X 1 1 → M 1 1 , . . . , X 1 ℓ → M 1 ℓ , X 2 → M 2 , . . . , X k → M k }) We choose R 1 = R 1 {X 1 1 → M 1 1 , . . . , X 1 ℓ → M 1 ℓ } and R 2 = M 2 , . . . , R k = M k .
Thus, the equation (⋆) can be rewritten as follows:

K| solved |= i(U {X 1 → R 1 , . . . , X k → R k }, V {X 1 → R 1 , . . . , X k → R k }).
This allows us to conclude. Now we show that if the same term can be derived with two recipes then the equality between the two statements is a consequence of the solved knowledge base. Proposition 4.1 (completeness, equation). Let K be a saturated knowledge base, and M, N be two terms such that k(M, t) ∈ deriv(K| solved ) and k(N, t) ∈ deriv(K| solved ) for some ground term t. Then, we have that K| solved |= i(M, N ).

Proof. By definition of k(M, t) ∈ deriv(K| solved ) we know that there exist a substitution σ 1 and a deduction statement

f 1 = k(M 0 , u 0 ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) in K such that u 0 σ 1 = t, k(M i , x i σ 1 ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k and M 0 {X i → M i } 1≤i≤k = M .
Similarly, by definition of k(N, t) ∈ deriv(K| solved ) we know that there exist a substitution σ 2 and a deduction statement

f 2 = k(N 0 , v 0 ) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ , y ℓ ) in K such that v 0 σ 2 = t, k(N j , y j σ 2 ) ∈ deriv(K| solved ) for all 1 ≤ j ≤ ℓ and N 0 {Y j → N j } 1≤i≤ℓ = N .
We prove the result by induction on |t|. As our knowledge base K is saturated, rule Unifying must have been applied to the statements f 1 and f 2 . Therefore, we have that there exists an equational statement f 3 ∈ K such that:

f 3 = i(M 0 , N 0 ) ⇐ k(X 1 , x 1 σ), . . . , k(X k , x k σ), k(Y 1 , y 1 σ), . . . , k(Y ℓ , y ℓ σ) .
where σ = mgu(u 0 , v 0 ). Let σ ′ be a substitution such that σ 1 ∪ σ 2 = σσ ′ . We can now apply Lemma 4.4 on f 3 with substitution σ ′ . We obtain that there exist R 1 , . . . , R k and W 1 , . . . , W ℓ such that k(R i , x i σσ ′ ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k and k(W j , y j σσ ′ ) ∈ deriv(K| solved ) for all 1 ≤ j ≤ ℓ and such that

K| solved |= i(M 0 δ, N 0 δ) (4.1)
where

δ = {X 1 → R 1 , . . . , X k → R k , Y 1 → W 1 , . . . , Y ℓ → W ℓ }. As M i and R i (1 ≤ i ≤ k) are such that k(M i , x i σ 1 )
∈ deriv(K| solved ) and k(R i , x i σσ ′ ) ∈ deriv(K| solved ), and as x 1 σσ ′ = x 1 σ 1 is a strict subterm of u 0 σ 1 = t, we can apply the induction hypothesis to obtain that K| solved |= i(M i , R i ). In a similar way, we also deduce that K| solved |= i(N j , W j ) for all 1 ≤ j ≤ ℓ. By replacing W j by M j and R i by N i in equation (4.1), we obtain our conclusion.

We now need a helper lemma that shows that if a derivable term is instantiated with derivable terms, the result is still derivable. Lemma 4.5. Let K be a knowledge base and t be a term. Let σ be a grounding substitution for t.

If k(W, t) ∈ deriv(K) and k(R x , xσ) ∈ deriv(K) for every x ∈ Var (t), then k(W ′ , tσ) ∈ deriv(K) where W ′ = W {x → R x } x∈Var (t) .
Proof. We show this result by induction on |t|. Base case: if |t| = 1.

• If t = x is a variable, as k(W, t) ∈ deriv(K), it follows that W = t = x. By hypothesis, there exists R x such that k(R x , xσ) ∈ deriv(K)
. This allows us to conclude.

• If t is a name or a constant, then W ′ = W and tσ = t and we immediately conclude.

Induction case: |t| > 1.
As k(W, t) ∈ deriv(K), it follows that there exist a statement f ∈ K and a substitution τ such that:

• f = k(R, u) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) ; • t = uτ ; • k(R i , x i τ ) ∈ deriv(K) for every 1 ≤ i ≤ k and W = R{X 1 → R 1 , . . . , X k → R k }.
We have that Var (u) = {x 1 , . . . , x k } and thus,

x i τ is a strict subterm of uτ (1 ≤ i ≤ k).
Therefore, we can apply our induction hypothesis on each term x i τ with the substitution σ. For each i such that 1 ≤ i ≤ k, we obtain that:

k(W i , x i τ σ) ∈ deriv(K) where W i = R i {x → R x } x∈Var (xiτ ) .
Note that since t = uτ and Var (u) = {x 1 , . . . , x k }, we have that Var (t) = Var ({x 1 τ, . . . , x k τ }). By using the statement f , we get that k(W ′′ , uτ σ) ∈ deriv(K) where

W ′′ = R{X 1 → R 1 {x → R x } x∈Var (t) , . . . , X k → R k {x → R x } x∈Var (t) } = (R{X 1 → R 1 , . . . , X k → R k }){x → R x } x∈Var (t) = W {x → R x } x∈Var (t) Let W ′ = W {x → R x } x∈Var (t)
. We have that k(W ′ , uτ σ) ∈ deriv(K) and since uτ σ = tσ we easily conclude.

We now show the completeness of the ⊕ operator with respect to solved statements.

Lemma 4.6. Let f = k(R, t) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k
) be a solved statement and K be a knowledge base such that K ⊕ f = K. Let σ be a substitution grounding for {x 1 , . . . , x k } such that k(T ′ i , x i σ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k. Then there exist W and R i for all 1 ≤ i ≤ k such that:

• k(W, tσ) ∈ deriv(K| solved ), and k(R i , x i σ) ∈ deriv(K| solved ) for every 1 ≤ i ≤ k;

• K| solved |= i(W, R{X 1 → R 1 , . . . , X k → R k }).
Proof. Let f ′ = f ⇓ be the canonical form of f . We first show that K ∪{f ′ } = K implies that there exists T ′ such that k(T ′ , t) ∈ deriv(K| solved ). This is easily shown by induction on the number of steps to compute the canonical form.

Base case: If f is already in canonical form we have that f = f ′ and hence there exists T ′ such that k(T ′ , t) ∈ deriv(K| solved ). Inductive case: The two rules are of the form

k(R, t) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) f 0 = k(R ′ , t) ⇐ k(X 1 , x 1 ), . . . , k(X i-1 , x i-1 ), k(X i+1 , x i+1 ), . . . , k(X k , x k ) Let f ′ 0 be the canonical form of f 0 . By the induction hypothesis we have K ∪ {f ′ 0 } = K implies that there exist T ′ such that k(T ′ , t) ∈ deriv(K| solved ). As f ′ = f ′ 0 we conclude.
To prove the lemma we consider both cases where f is either useful or redundant.

Useful statement: If f is useful we have that k(T ′ , t) ∈ deriv(K| solved ) for some T ′ . By usefulness, K ∪ {f ⇓} = K which contradicts that K ⊕ f = K. Hence, this case is impossible.

Redundant statement: Since K ⊕ f = K, it follows that there exists W ′ such that k(W ′ , t) ∈ deriv(K| solved ) and Lemma 4.5, we deduce that k(W ′′ , tσ) ∈ deriv(K| solved ) and we also have that

K |= i(W ′ , R{X 1 → x 1 , . . . , X k → x k }).We choose R i arbitrarily such that k(R i , x i σ) ∈ deriv(K| solved ). Let W ′′ = W ′ {x 1 → R 1 , . . . , x k → R k }. By
K| solved |= i(W ′ , (R{X 1 → x 1 , . . . , X k → x k }){x 1 → R 1 , . . . , x k → R k }) i.e. K| solved |= i(W ′′ , R{X 1 → R 1 , . . . , X k → R k }).
Let W = W ′′ . We have that k(W, tσ) ∈ deriv(K| solved ), and k(R i , x i σ) ∈ deriv(K| solved ) for every 1 ≤ i ≤ k. Lastly, we have that

K |= i(W, R{X 1 → R 1 , . . . , X k → R k }).
We now show the completeness of the ⊕ operator with respect to any type of deduction statements.

Lemma 4.7. Let K be a saturated knowledge base. Let f = k(R, t) ⇐ k(X 1 , t 1 ), . . . , k(X k , t k ) be a deduction statement such that K ⊕ f = K. For any substitution σ grounding for {t 1 , . . . , t k } such that k(T ′ i , t i σ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k, we have that there exist R 1 , . . . , R k and W such that • k(W, tσ) ∈ deriv(K| solved ), and k(R i , t i σ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k; • K| solved |= i(W, R{X 1 → R 1 , . . . , X k → R k }).
Proof. We show the result by induction on k i=1 |t i σ|. We distinguish two cases. If f is solved then we easily conclude by applying Lemma 4.6.

If f is not solved, there exists j such that t j ∈ X . We assume w.l.o.g. that j = 1. Since k(T ′ 1 , t 1 σ) ∈ deriv(K| solved ), there exist a solved deduction statement f ′ ∈ K, some terms R ′ i (1 ≤ i ≤ ℓ) and a substitution τ such that:

• f ′ = k(R ′ , t ′ ) ⇐ k(Y 1 , y 1 ), . . . , k(Y ℓ , y ℓ ) ; • t ′ τ = t 1 σ; • k(R ′ i , y i τ ) ∈ deriv(K| solved ) for every 1 ≤ i ≤ ℓ.
By application of the F-Solving rule to the deduction statements f and f ′ , we obtain the following statement

f 0 = k(R{X 1 → R ′ }, tρ) ⇐ k(X 2 , t 2 ρ), . . . , k(X k , t k ρ), k(Y 1 , y 1 ρ), . . . , k(Y ℓ , y ℓ ρ) where ρ = mgu(t ′ , t 1 ). As K is saturated, K ⊕ f 0 = K. Let σ ′ be the substitution such that σ ∪ τ = ρσ ′ . As y i ρσ ′ = y i (σ ∪ τ ) = y i τ are strict disjoint subterms of t ′ τ = t 1 σ
, it follows that we can apply our induction hypothesis on f 0 and the substitution σ ′ . Therefore, there exist R ′ 2 , . . . , R ′ k , R y 1 , . . . , R y ℓ and W ′ such that:

• k(W ′ , tρσ ′ ) ∈ deriv(K| solved ), • k(R ′ i , t i ρσ ′ ) ∈ deriv(K| solved ) for every 2 ≤ i ≤ k, • k(R y j , y j ρσ ′ ) ∈ deriv(K| solved ) for every 1 ≤ j ≤ ℓ, • K| solved |= i(W ′ , (R{X 1 → R ′ }){X 2 → R ′ 2 , . . . , X k → R ′ k , Y 1 → R y 1 , . . . , Y ℓ → R y ℓ }). Let W = W ′ , R 1 = R ′ {Y 1 → R y 1 , . . . , Y ℓ → R y ℓ }, R j = R ′ j for every 2 ≤ j ≤ k. It immediately follows that K |= i(W, R{X 1 → R 1 , . . . , X k → R k }), k(W, tσ) ∈ deriv(K| solved ) and k(R i , t i σ) ∈ deriv(K| solved ) for 1 ≤ i ≤ k.
This allows us to conclude.

We now show that the saturation process is complete with respect to the rewrite system. Proposition 4.2 (completeness, reduction). Let K be a saturated knowledge base, M a term and t a ground term such that k(M, t) ∈ deriv(K| solved ) and t↓ = t. Then there exist M ′ and t ′ such that k(M ′ , t ′ ) ∈ deriv(K| solved ) with t → + t ′ and K| solved |= i(M, M ′ ).

Proof. We show this result by induction on |t|. By definition of k(M, t) ∈ deriv(K| solved ), we know that there exist

f 0 = k(M 0 , u 0 ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) in K and a substitution σ such that u 0 σ = t and k(M i , x i σ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k and M 0 {X i → M i } 1≤i≤k = M for some M i (1 ≤ i ≤ k).
We distinguish two cases: Case 1: there exists 1 ≤ j ≤ k such that x j σ↓ = x j σ. Let us assume w.l.o.g. that j = 1. Since x 1 σ is a strict subterm of t, we can apply our induction hypothesis on x 1 σ. We obtain that there exist

M ′ 1 and u ′ 1 such that k(M ′ 1 , u ′ 1 ) ∈ deriv(K| solved ) with x 1 σ → + u ′ 1 and K| solved |= i(M 1 , M ′ 1 )
. Now, let σ ′ be the substitution defined as follows:

xσ ′ = xσ for x = x 1 u ′ 1 otherwise Let t ′ = u 0 σ ′ and M ′ = M 0 {X 1 → M ′ 1 , X 2 → M 2 , . . . , X k → M k }. Since x 1 ∈ Var (u 0 ), it is easy to see that t = u 0 σ → + u 0 σ ′ = t ′ . Furthermore, it is also easy to see that k(M ′ , t ′ ) ∈ deriv(K| solved ). Lastly, since K| solved |= i(M 1 , M ′ 1 )
, we have that K| solved |= i(M, M ′ ). Case 2: x j σ↓ = x j σ for every 1 ≤ j ≤ k. In such a case, we have that u 0 = C[u ′ 0 ] for some context C and some term u ′ 0 ∈ X such that u ′ 0 σ = lτ where l → r ∈ R and τ is a substitution. As the knowledge base K is saturated, the rule Narrowing must have been applied. Therefore there exists f 1 such that:

• K ⊕ f 1 = K, and • f 1 = k(M 0 , (C[r])ρ) ⇐ k(X 1 , x 1 ρ), . . . , k(X k , x k ρ)
where ρ = mgu(u ′ 0 , l). Let ρ ′ be the substitution with Dom(ρ ′ ) = Var ({x 1 ρ, . . . , x k ρ}) and σ ∪ τ = ρρ ′ . Now, we apply Lemma 4.7 on the statement f 1 and the substitution ρ ′ . We deduce that there exist R 1 , . . . , R k and W such that

• k(W, (C[r])ρρ ′ ) ∈ deriv(K| solved ), and k(R i , x i ρρ ′ ) ∈ deriv(K| solved ) for 1 ≤ i ≤ k; and • K| solved |= i(W, M 0 {X 1 → R 1 , . . . , X k → R k }). Let t ′ = (C[r])ρρ ′ and M ′ = W . We have that k(M ′ , t ′ ) ∈ deriv(K| solved ). Moreover, since k(R i , x i ρρ ′ ) ∈ deriv(K| solved ), k(M i , x i σ) ∈ deriv(K| solved ) and x i ρρ ′ = x i σ, we can apply Lemma 4.1 in order to deduce that K| solved |= i(R 1 , M i ) for 1 ≤ i ≤ k. Thus, we have that K| solved |= i(M, M ′ ). In order to conclude, it remains to show that t → + R E t ′ . Indeed, we have that t = u 0 σ = (C[u ′ 0 ])σ → + R E (C[r])ρρ ′ = t ′ .
The soundness and completeness of the saturation procedure is given by the following theorem:

Theorem 4.1. Let ϕ be a frame and K be a saturated knowledge base such that Init(ϕ) =⇒ * K.

Let t ∈ T (F) and let

K + = K ∪ { k(n, n) ⇐ | n ∈ N ames(t) \ N }. Then 1.
for all terms M we have that:

ϕ ⊢ M t iff there exists N such that K| solved |= i(M, N ) and k(N, t↓) ∈ deriv(K + | solved )
2. and for all terms M, N we have that

(M = N )ϕ iff K| solved |= i(M, N ).
Proof. Let ϕ be a frame and K be a saturated knowledge base such that Init(ϕ) =⇒ * K.

1.(⇐) Let M , N and t be such that K| solved |= i(M, N ) and k(N, t↓) ∈ deriv(K + | solved ). By Lemma 4.3, we have that M ϕ = R N ϕ = R t.

(⇒) Let M and t be such that ϕ ⊢ M t.

Let K ++ = K ∪ { k(n, n) ⇐ | n ∈ N ames(M )}. We have that k(M, t 0 ) ∈ deriv(K ++ | solved ) and t 0 → * t↓ with t 0 = M ϕ.
Let {n 1 , . . . , n ℓ } = N ames(M ) \ N ames(ϕ, t). Let y 1 , . . . , y ℓ be fresh variables and

δ = {n 1 → y 1 , . . . , n ℓ → y ℓ }. Let M ′ = M δ. We have that k(M ′ , t ′ 0 ) ∈ deriv(K ++ | solved ) and t ′ 0 → * t↓ with t ′ 0 = M ′ ϕ. Now, let K +++ = K ++ ∪ { i(n, n) ⇐ | n ∈ N ames(M )}.
As K is a saturated knowledge base, we have that K +++ is a saturated knowledge base as well. By Proposition 4.1, we deduce that K| +++ solved |= i(M, M ′ ), thus K| solved |= i(M, M ′ ) as well. We show the result by induction on t 0 equipped with the order < induced by the rewriting relation (t < t ′ if and only if t ′ → + t).

Base case: k(M ′ , t 0 = t↓) ∈ deriv(K + | solved ) Let N = M ′ , we have K| solved |= i(M, N ) and k(N, t↓) ∈ deriv(K| solved ). Induction case: k(M ′ , t 0 ) ∈ deriv(K + | solved ) with t 0 = t↓. Let K + = K ∪ { i(n, n) ⇐ | n ∈ N ames(t) \ N }.
We easily see that as K is a saturated knowledge base we have that K + is a saturated knowledge base as well. Hence we can apply Proposition 4.2 and deduce that there exist N ′ and t ′ such that k(N ′ , t ′ ) ∈ deriv(K + | solved ), t → + t ′ , and K| + solved |= i(M ′ , N ′ ). It is easy to see that K| solved |= i(M ′ , N ′ ) as well. We have that k(N ′ , t ′ ) ∈ deriv(K + | solved ), t ′ → * t↓ and t ′ < t 0 . Thus, we can apply our induction hypothesis and we obtain that there exists N such that K| solved |= i(N ′ , N ) and k(N, t↓) ∈ deriv(K + | solved ). (⇒) Let M and N be terms such that (M = N )ϕ. This means that there exists t such that ϕ ⊢ M t and ϕ ⊢ R t.

Let K + = K ∪ { k(n, n) ⇐ | n ∈ N ames(t) \ N } and K ++ = K + ∪ { i(n, n) ⇐ | n ∈ N ames(t) \ N }. By applying Item 1, we deduce that there exist M ′ , N ′ such that K| solved |= i(M, M ′ ), k(M ′ , t↓) ∈ deriv(K + | solved ), K| solved |= i(N, N ′ ) and k(N ′ , t↓) ∈ deriv(K + | solved ). It is easy to see that K ++ | solved |= i(M, M ′ ) and K ++ | solved |= i(N, N ′ ) as well. Because K ++

Application to Deduction and Static Equivalence

We now show how to use the saturation procedure above in order to check if a term is deducible from a frame (and provide an appropriate recipe) and respectively if two frames are statically equivalent. Procedure for deduction.

Let ϕ be a frame and t be a ground term. The procedure for checking if ϕ ⊢ R t for some R runs as follows:

1. Apply the saturation rules to obtain (if any) a saturated knowledge base K such that

Init(ϕ) =⇒ * K. Let K + = K ∪ { k(n, n) ⇐ | n ∈ N ames(t) \ N }. 2. Return yes if there exists R such that k(R, t↓) ∈ deriv(K + | solved ) (in this case R is a recipe
for t in the frame ϕ); otherwise return no (in this case t is not deducible from ϕ).

Proof. If the algorithm returns yes, there exists R such that k(R, t↓) ∈ deriv(K + | solved ). As K |= i(R, R), by Theorem 4.1 we have that ϕ ⊢ R t.

Conversely, if t is deducible from ϕ, then there exists R such that ϕ ⊢ R t. By Theorem 4.1, there exists N such that k(N, t↓) ∈ deriv(K + | solved ). Hence, the algorithm returns yes. Example 4.9. ex:algodeduc We continue our running example. Let K be the knowledge base obtained from Init(ϕ 2 ) described in Example 4.8. We show that ϕ 2 ⊢ enc(c, k) and ϕ 2 ⊢ b. Indeed we have that

k(mal(w 1 , c), enc(c, k)) ∈ deriv(K| solved ∪ { k(c, c) ⇐ }) using statements f 9 and k(c, c) ⇐ , and k(b, b) ∈ K| solved using statement f 2 .
Procedure for static equivalence. Let ϕ 1 and ϕ 2 be two frames. The procedure for checking ϕ 1 ≈ ϕ 2 runs as follows:

1. Apply the transformation rules to obtain (if possible) two saturated knowledge bases

K i (i ∈ {1, 2}) such that Init(ϕ i ) =⇒ * K i for 1 ≤ i ≤ 2. Let L i denote the solved statements of K i (1 ≤ i ≤ 2). 2. For {i, j} = {1, 2}, for every solved statement i(M, N ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) in L i , check if (M σ = N σ)ϕ j where σ = {X 1 → x 1 , . . . , X k → x k }.
3. If so return yes; otherwise return no.

Proof. If the algorithm returns yes, this means that (⋆): for every solved equational fact i(M, N ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) in L 1 , we have that:

(M σ = N σ)ϕ 2 where σ = {X 1 → x 1 , . . . , X k → x k }.
Let M, N be terms such that (M = N )ϕ 1 . By Theorem 4.1, we have that L 1 |= i(M, N ). By (⋆), we deduce that (M = N )ϕ 2 . The other direction is analogous.

Conversely, assume now that

ϕ 1 ≈ ϕ 2 . Let i(M, N ) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) be a solved
equational fact in L 1 and let us show that ( M = Ñ )ϕ 2 where

• M = M {X 1 → x 1 , . . . , X k → x k }, and
• Ñ = N {X 1 → x 1 , . . . , X k → x k }.
(The other case is analogous, and we will conclude that the algorithm returns yes.) Let {y 1 , . . . , y ℓ } = Var (M, N ) and n 1 , . . . , n ℓ be ℓ fresh public names that do not occur in

N ames(ϕ 1 ) ∪ N ames(ϕ 2 ) ∪ N ames(M, N ). Let δ = {y 1 → n 1 , . . . , y ℓ → n ℓ }. Since L 1 |= i( M , Ñ ), we have also that L 1 |= i( M δ, Ñ δ). By Theorem 4.1, we have that ( M δ = Ñ δ)ϕ 1 . As ϕ 1 ≈ ϕ 2 ,
we have also that ( M δ = Ñ δ)ϕ 2 , and thus ( M = Ñ )ϕ 2 . This allows us to conclude.

Termination

The saturation process does not always terminate.

Example 4.11. Consider the convergent rewriting system consisting of the single rule f (g(x)) → g(h(x)) and the frame ϕ = {w 1 → g(a)} where a ∈ N is a private name. We have that

Init(ϕ) ⊇ { k(w 1 , g(a)) ⇐ , k(f (X), f (x)) ⇐ k(X, x) }.
By Narrowing we can add the statement

f 1 = k(f (X), g(h(x)) ⇐ k(X, g(x)
) . Then we can apply F-Solving to solve its antecedent k(X, g(x)) with the statement k(w 1 , g(a)) ⇐ yielding the solved statement k(f (w 1 ), g(h(a))) ⇐ . Now, applying iteratively F-Solving on f 1 and the newly generated statement, we generate an infinity of solved statements of the form k(f (. . . f (w 1 ) . . .), g(h(. . . h(a) . . .))) ⇐ . Intuitively, this happens because our symbolic representation is unable to express that the function h can be nested an unbounded number of times when it occurs under an application of g.

The same kind of limitation already exists in the procedure implemented in the tool YAPA [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF]. However, our symbolic representation which manipulates terms that are not necessarily ground and statements with antecedents allows us to go beyond YAPA. We are able for instance to treat equational theories such as malleable encryption and trapdoor commitment.

Generic Method for Proving Termination

We provide a generic method for proving termination, which we instantiate on several examples. In order to prove that the saturation algorithm terminates, we require the update function ⊕ to be uniform: i.e., the same recipe R ′ be used for all redundant solved deduction statements that have the same canonical form. Note that the soundness and completeness of the algorithm does not depend on the choice of the recipe R ′ when updating the knowledge base with a redundant statement (cf. Definition 4.4). Definition 4.5 (projection). We define the projection f of a deduction statement

f = k(R, t) ⇐ k(X 1 , t 1 ), . . . , k(X n , t n ) to be the Horn clause f = t ⇐ t 1 , . . . , t n .
We extend the projection to sets of statements K and define

K = { f | f ∈ K}.
As usual, we identify projections which are equal up to bijective renaming of variables and we sometimes omit braces for the antecedents. Proposition 4.3 (generic termination). The saturation algorithm terminates if ⊕ is uniform and there exist some functions Q, m f , m e and some well-founded orders < f and < e such that for all frames ϕ, and for all knowledge bases K such that Init(ϕ) =⇒ * K, we have that:

1. { f | f ∈ K| solved and f is a deduction statement} ⊆ Q(ϕ) and Q(ϕ) is finite; 2. m f (f 0 ) < f m f (f 1 )
where f 0 , f 1 are defined as in rule F-Solving;

3. m e (f 0 ) < e m e (f 1 ) where f 0 , f 1 are defined as in rule E-Solving.

Proof. A solved deduction statement f is only added to K if there is no f ′ ∈ K such that f = f ′ . Indeed, if f = f ′ then f is redundant and an equational statement will be added instead. As { f | f ∈ K| solved and f is a deduction statement} ⊆ Q(ϕ) and Q(ϕ) is finite we conclude that only a finite number of solved deduction statements are in K.

An unsolved deduction statement f can be added in two ways.

• f can be added by the rule Narrowing. Since the number of solved deduction statements and the number of rewriting rules are finite the number of statements added by the rule Narrowing is also finite.

• f can be added by the rule F-Solving. The number of statements added by the rule F-Solving is bounded by the measure m f which is strictly decreasing for a well-founded order.

An equational statement f can be added in three ways.

• f can be added when the knowledge base is updated with a redundant deduction statement. However, since ⊕ is uniform only a finite number of such statements is added.

• f can be added by the rule Unifying. Since the number of solved deduction statements is finite, the number of statements added by Unifying is bounded.

• f can be added by the rule E-Solving. The number of statements added by rule E-Solving is bounded by the measure m e which is strictly decreasing for a well-founded order.

Altogether, this allows us to conclude.

Applications

We now give several examples for which the saturation procedure indeed terminates. For each of these theories the definition of the function Q relies on the following notion of extended subterm.

Definition 4.6 (extended subterm). Let t be a term, its set of extended subterms st ext (t) (w.r.t. R), is the smallest set such that:

1. t ∈ st ext (t), 2. f (t 1 , . . . , t k ) ∈ st ext (t) implies t 1 , . . . , t k ∈ st ext (t), 3. t ′ ∈ st ext (t) and t ′ → t ′′ implies t ′′ ∈ st ext (t).
This notation is extended to frames in the usual way.

All examples in this section rely on the same m f and m e . Let {k(X 1 , t 1 ), . . . , k(X n , t n )} be the set of antecedents of a statement f . We define

m f (f ) = (|Var (t 1 , . . . , t n )|, 1≤i≤n |t i |)
and < f is the lexicographical order on ordered pairs of integers. The measure m e and the order < e are defined in the same way.

Subterm convergent equational theories. Abadi and Cortier [2] have shown that deduction and static equivalence are decidable for subterm convergent equational theories in polynomial time. We retrieve the same decidability results with our algorithm.

The termination proof for this class relies on the function Q where Q(ϕ) is defined as the smallest set that contains 1. t ⇐ ∅ , where t ∈ st ext (ϕ); 2. f (x 1 , . . . , x k ) ⇐ x 1 , . . . , x k , where ar(f ) = k. Lemma 4.8. For any frame ϕ, and any knowledge base K such that Init(ϕ) =⇒ K, we have that:

1. { f | f ∈ K and f is a solved deduction statement } ⊆ Q(ϕ) and Q(ϕ) is finite; 2. m f (f 0 ) < f m f (f 1 )
where f 0 , f 1 are defined as in rule F-Solving;

3. m e (f 0 ) < e m e (f 1 ) where f 0 , f 1 are defined as in rule E-Solving where Q, m f , m e , < f , and < e are defined w.r.t. the rewrite system as described above.

Proof. The proof of item 1 is done by induction on the number of saturation steps needed to reach K. To ease the induction we strengthen the induction hypothesis and prove a slightly stronger statement. We define Q ′ (ϕ, K) as the smallest set such that

1. t ⇐ ∅ ∈ Q ′ (ϕ, K), where t ∈ st ext (ϕ) 2. f (x 1 , . . . , x k ) ⇐ x 1 , . . . , x k ∈ Q ′ (ϕ, K), where ar(f ) = k 3. rσ ⇐ t 1 , . . . , t k ∈ Q ′ (ϕ, K)
, where:

• l → r ∈ R • σ : Var (l) → st ext (ϕ) is a partial function • lσ = C[t 1 , . . . , t k ] for some context C • rσ ∈ st(D[t 1 , . . . , t k , u 1 , . . . , u n ]
) for some public context D and some terms u i such

that u i ⇐ ∈ K • ∃i : t i ∈ X
In the following when a projection f corresponds to one of the above 3 cases, we say that f is of type i (1 ≤ i ≤ 3). Note that a solved deduction statement is either of type 1 or 2. We prove that for any K such that Init(ϕ

) =⇒ * K we have that { f | f ∈ K and f is a deduction statement} ⊆ Q ′ (ϕ, K). We have that { f | f ∈ Q ′ (ϕ, K) and f is solved} ⊆ Q(ϕ)
and this allows us to conclude.

We prove the result by induction on the number of saturation steps of Init(ϕ) =⇒ * K.

Base case. It is clear that for all deduction statements f ∈ Init(ϕ) we have that f is either of type 1 or type 2.

Inductive case. We assume that the result holds for K, i.e. K ⊆ Q ′ (ϕ, K), and show that any possible application of a saturation rule preserves the result.

1. Consider a statement f ∈ K of type 1, i.e. f = t ⇐ . By applying rule Narrowing to it, we obtain a statement

f ′ such that f ′ = t ′ ⇐ with t → t ′ . As t ∈ st ext (ϕ), we have that t ′ ∈ st ext (ϕ) and therefore f ′ is of type 1. 2. Consider a statement f ∈ K of type 2, i.e. f = f (x 1 , . . . , x k ) ⇐ x 1 , . . . , x k .
As all positions of the term f (x 1 , . . . , x k ), except the head are variables, rule Narrowing can only be applied at this position. Let l → r ∈ R be the rewrite rule involved in this step. We obtain a statement f ′ such that f ′ = rτ ⇐ x 1 τ, . . . , x k τ where τ = mgu(f (x 1 , . . . , x k ), l).

By the definition of a rewrite rule, l is not a variable. Therefore, we have that l = f (l 1 , . . . , l k ) for some terms l 1 , . . . , l k and f ′ = r ⇐ l 1 , . . . , l k . Let σ be such that Dom(σ) = ∅, C = f ( , . . . , ). It is clear that f ′ satisfies the three first conditions of a statement of type 3. Now, either r ∈ T (F, ∅) (i.e. r is a public ground term) and in such a case it is clear that the statement is redundant. Otherwise, we have that r is a strict subterm of l, i.e r ∈ st(l j ) for some 1 ≤ j ≤ k. Therefore the fourth condition also holds. Now, assume that all the l i are variables (i.e. f ′ is solved), we show it is redundant and it is not added to the knowledge base. Indeed, in such a situation, we necessarily have that r is a variable (remember that r ∈ st(l j )) and therefore the statement f ′ is redundant. Otherwise, the resulting fact is of type 3.

3. Consider a statement f ∈ K of type 3. Let f = rσ ⇐ t 1 , . . . , t k . In such a case, there exist a rewrite rule l → r, a partial function σ :

Var (l) → st ext (ϕ), a context C such that lσ = C[t 1 , . . . , t k ] and we have that rσ ∈ st(D[t 1 , . . . , t k , u 1 , . . . , u n ]
) for some public context D and some terms u i such that u i ⇐ ∈ K. Assume that one of the antecedents of f is being solved by rule F-Solving with a solved statement f ′ ∈ K. We assume w.l.o.g. that t 1 is being solved. We distinguish two cases depending on the type of f ′ .

• Case 1:

f ′ = u 0 ⇐ . Let τ = mgu(u 0 , t 1 )
. The projection of the statement resulting from the F-Solving rule is f ′′ = rστ ⇐ t 2 τ, . . . , t k τ . We consider σ ′ = τ ∪ σ, C ′ = C[u 0 , . . . , ] and D ′ = D. We can show that the first four conditions hold. If the last condition does not hold, and because the fourth holds, the resulting statement must be either of type 1 or redundant and therefore not added to the knowledge base.

• Case 2:

f ′ = f (x 1 , . . . , x k ) ⇐ x 1 , . . . , x k . Let τ = mgu(f (x 1 , . . . , x k ), t 1 ). As t 1
is not a variable, we have that t 1 = f (s 1 , . . . , s ℓ ). The projection statement resulting from the application of the rule F-Solving is f ′′ = rσ ⇐ s 1 , . . . , s ℓ , t 2 , . . . , t k . We can show that the first four conditions hold. If the last condition does not hold, and because the fourth holds, the resulting statement must be either of type 1 or redundant and therefore not added to the knowledge base.

To show items 2 and 3 it remains to be proven that m f and m e strictly decrease after an antecedent of an unsolved statement is solved. As an antecedent can only be solved by statements of type 1 or 2 this is easily shown by a case analysis. We detail the proof for m f . The case of m e can be done in a similar way.

Let

f 1 = k(R, t) ⇐ k(X 1 , t 1 ), . . . k(X n , t n ) .
• Suppose f 1 is solved by a solved statement f 2 of type 1. Let f2 = u ⇐ where u ∈ st ext (ϕ) and σ = mgu(u, t 1 ). There are two possible cases. Either u = t 1 . As u ∈ st ext (ϕ) we have that u is ground and This allows us to conclude the proof.

Dom(σ) = ∅. In this case |Var (t 2 , . . . , t n )| = |Var (t 1 , . . . , t n )| but 2≤i≤n |t i | < 1≤i≤n |t i |. Or u = t 1 and |Var (t 2 , . . . t n )| < |Var (t 1 , . . . t n )|. • Suppose f 1 is solved by a solved statement f 2 of type 2. Let f2 = f (x 1 , . . . , x k ) ⇐ x 1 , . . . , x k and σ = mgu(u, t 1 ). As t 1 ∈ X we have that t 1 = f (s 1 , . . . , s k ). We have that σ = {x 1 → s 1 , . . . , x k → s k } and the resulting statement f 0 is such that f0 = tσ ⇐ s 1 , . . . ,
Malleable encryption. We also obtain termination for the equational theory E mal described in Example 4.1. This is a toy example that does not fall in the class studied in [2]. Indeed, this theory is not locally stable: the set of terms in normal form deducible from a frame ϕ cannot always be obtained by applying public contexts over a finite set (called sat(ϕ) in [2]) of ground terms.

As a witness, let k ∈ N be a private name and consider the frame ϕ 2 = {w 1 → enc(b, k)} introduced in Example 4.7. Among the terms that are deducible from ϕ 2 , we have those of the form enc(t, k) where t represents any term deducible from ϕ 2 . From this observation, it is easy to see that E mal is not locally stable.

Our procedure does not have this limitation. A prerequisite for termination is that the set of terms in normal form deducible from a frame is exactly the set of terms obtained by nesting in all possible ways a finite set of contexts. The theory E mal falls in this class. In particular, for the frame ϕ 2 , our procedure produces the statement

f 9 = k(mal(w 1 , Y 2 ), enc(z, k)) ⇐ k(Y 2 , z) allowing us
to capture all the terms of the form enc(t, k) by the means of a single deduction statement.

The termination proof relies on the function Q where Q(ϕ) is defined as the smallest set that contains:

1. t ⇐ , for every t ∈ st ext (ϕ); 2. f (x 1 , x 2 ) ⇐ x 1 , x 2
, where f ∈ {enc, dec, mal}; 3. enc(x, t) ⇐ x , if there exists t ′ such that enc(t ′ , t) ∈ st ext (ϕ). Lemma 4.9. For any frame ϕ, and any knowledge base K such that Init(ϕ) =⇒ * K, we have that:

1. { f | f ∈ K and f is a solved deduction statement } ⊆ Q(ϕ) and Q(ϕ) is finite; 2. m f (f 0 ) < f m f (f 1 )
where f 0 , f 1 are defined as in rule F-Solving;

3. m e (f 0 ) < e m e (f 1 ) where f 0 , f 1 are defined as in rule E-Solving where Q, m f , m e , < f , and < e are defined as described above.

Proof. The proof of item 1 is done by induction on the number of saturation steps of Init(ϕ) =⇒ * K. To ease the induction we strengthen the induction hypothesis and prove a slightly stronger statement. We define Q ′ (ϕ) as the smallest set such that:

1. t ⇐ ∈ Q ′ (ϕ), for every t ∈ st ext (ϕ) 2. f (x 1 , x 2 ) ⇐ x 1 , x 2 ∈ Q ′ (ϕ), where f ∈ {enc, dec, mal} 3. enc(x, t) ⇐ x ∈ Q ′ (ϕ), if there exists t ′ such that enc(t ′ , t) ∈ st ext (ϕ) 4. x ⇐ enc(x, y), y ∈ Q ′ (ϕ) 5. enc(z, y) ⇐ enc(x, y), z ∈ Q ′ (ϕ) 6. t ⇐ t 1 , . . . , t k ∈ Q ′ (ϕ), if t ∈ st ext (ϕ) and C[t 1 , . . . , t k ] ∈ st ext (ϕ) for some context C 7. x ⇐ x, t 1 , . . . , t k , where C[t 1 , . . . , t k ] ∈ st ext (ϕ) for some context C
In the following when a projection f corresponds to one of the above 7 cases, we say that f is of type i (1 ≤ i ≤ 7). We prove that for any knowledge base K such that Init(ϕ

) =⇒ * K we have that { f | f ∈ K and f is a deduction statement} ⊆ Q ′ (ϕ). It is easy to see that { f | f ∈ Q ′ (ϕ)
and f is solved} ⊆ Q(ϕ) and this will indeed allows us to conclude.

We prove the result by induction on the number of saturation steps of Init(ϕ) =⇒ * K.

Base case. It is clear that for all deduction statements f ∈ Init(ϕ) we have that f is either of type 1 or type 2.

Inductive case. We assume that the result holds for K and show that any possible application of a saturation rule preserves the result.

• Consider a statement f ∈ K of type 1, i.e. f = t ⇐ with t ∈ st ext (ϕ). By applying rule Narrowing, we obtain a statement f ′ such that f ′ = t ′ ⇐), and t → t ′ . As t ∈ st ext (ϕ), it follows that t ′ ∈ st ext (ϕ) and therefore f ′ is a statement of type 1.

• Consider a statement f ∈ K of type 2 such that f = f (x 1 , x 2 ) ⇐ x 1 , x 2 .
By applying the rule Narrowing we obtain a statement of type 4, or 5.

• Consider a statement f ∈ K of type 3, then f = enc(x, t) | x and the rule Narrowing can only be applied on a position in t. Therefore, Narrowing will produce another statement f ′ = enc(x, u) ⇐ x , where t → u. As there exists t ′ such that enc(t ′ , t) ∈ st ext (ϕ) by definition of st ext , enc(t ′ , u) ∈ st ext (ϕ) yielding again a statement of type 3.

• Consider a statement f ∈ K of type 4, then its unsolved antecedents can be solved using a statement of type 1, 2 or 3. In the first case, we obtain a statement of type 6. In the second case, we obtain a redundant statement. In the third case, we obtain a statement of type 7.

• Consider a statement f ∈ K of type 5, its unsolved antecedent can be solved using a statement of type 1, 2 or 3. In the first case, we obtain a statement of type 3. In the second and third case, we obtain a redundant statement.

• Consider a statement f ∈ K of type 6 or 7, its unsolved antecedents can be solved using a statement of type 1, 2 or 3. Let f ′ be the new statement obtained by applying the F-Solving rule. If f ′ is unsolved, it has the same type as f . If

f ′ is solved, it is either of type 1 if f is of type 6 or it is redundant if f is of type 7.
To show items 2 and 3 it remains to be proven that m f and m e strictly decrease after an antecedent of an unsolved statement is solved. As antecedents can only be solved by statements of type 1 -3 this is easily shown by a case analysis. We detail the proof for m f . The case of m e can be done in a similar way.

Let

f 1 = k(R, t) ⇐ k(X 1 , t 1 ), . . . k(X n , t n ) .
The case where f 1 is solved by a statement f 2 of type 1 (resp. type 2) is similar to the proof done in Lemma 4.8. It remains the case where f 2 is of type 3.

Let f2 = enc(x, u) ⇐ x and σ = mgu(enc(x, u), t 1 ). As there exists u ′ such that enc(u ′ , u) ∈ st ext (ϕ) we have that u is ground. As t 1 ∈ X we have that

t 1 = enc(t ′ 1 , t ′′ 1 ). The projection of the resulting statement f 0 is f0 = tσ ⇐ xσ, t 2 σ, . . . , t n σ . We distinguish two cases. Either σ = {x → t ′ 1 } and f0 = t ⇐ t ′ 1 ,
, y) = x 2. tdcommit(x 2 , f(x 1 , y, z, x 2 ), z) = tdcommit(x 1 , y, z) 3. open(tdcommit(x 1 , y, z), f(x 1 , y, z, x 2 )) = x 2 4. f(x 2 , f(x 1 , y, z, x 2 ), z, x 3 ) = f(x 1 , y, z, x 3 )
We will refer below to the four corresponding rewrite rules as R1, R2, R3 and R4. As said in the introduction, we encountered this equational theory when studying electronic voting protocols. The term tdcommit(m, r, td) models the commitment of the message m under the key r using an additional trap-door td. Such a commitment scheme allows a voter who has performed a commitment to open it in different ways using its trap-door. Hence, trap-door bit commitment tdcommit(v, r, td) does not bind the voter to the vote v. This is useful to ensure privacy-type properties in e-voting and in particular receipt-freeness [START_REF] Okamoto | Receipt-free electronic voting schemes for large scale elections[END_REF]. With such a scheme, even if a coercer requires the voter to reveal his commitment, this does not give any useful information to the coercer as the commitment can be viewed as the commitment of any vote (depending on the key that will be used to open it).

For the same reason as E mal , the theory of trap-door commitment described below cannot be handled by the algorithms described in [2,[START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF]. Our termination proof relies on the function Q where Q(ϕ) is the smallest set that contains:

(ϕ), k ≥ 1 16. tdcommit(t, r, tp) ⇐ t 1 , . . . , t k , ∃t ′ f(t, r, tp, t ′ ) ∈ st ext (ϕ), t 1 , . . . , t k ∈ st ext (ϕ), k ≥ 1 17. tdcommit(t, r, tp) ⇐ x, t 1 , . . . , t k , ∃t ′ f(t, r, tp, t ′ ) ∈ st ext (ϕ), t 1 , . . . , t k ∈ st ext (ϕ), k ≥ 1 18. f(t, r, tp, x) ⇐ x, t 1 , . . . , t k , ∃t ′ f(t, r, tp, t ′ ) ∈ st ext (ϕ), t 1 , . . . , t k ∈ st ext (ϕ) 19. f(t, r, tp, x) ⇐ x, x ′ , t 1 , . . . , t k , ∃t ′ f (t, r, tp, t ′ ) ∈ st ext (ϕ), t 1 , . . . , t k ∈ st ext (ϕ)
In the following when a projection f corresponds to one of the above 19 cases, we say that

f is of type i (1 ≤ i ≤ 19). We prove that for any K such that Init(ϕ) =⇒ * K we have that { f | f ∈ K and f is a deduction statement} ⊆ Q ′ (ϕ). It is easy to see that { f | f ∈ Q ′ (ϕ) and f is solved} ⊆ Q(ϕ)
, which will indeed allows us to conclude. We prove the result by induction on the number of saturation steps of Init(ϕ) =⇒ * K.

Base case. It is clear that all deduction statements f ∈ Init(ϕ) are either of type 1 or type 3.

Inductive case. We assume that the result holds for K and show that any possible application of a saturation rule preserves the result. We summarize case analysis in the following two matrices. In the following when a projection f corresponds to one of the above 17 cases, we say that f is of type i (1 ≤ i ≤ 17). We prove that for any K such that Init(ϕ

Narrowing

) =⇒ * K we have that { f | f ∈ K and f is a deduction statement} ⊆ Q ′ (ϕ). It is easy to see that { f | f ∈ Q ′ (ϕ) and f is solved} ⊆ Q(ϕ)
, which will indeed allows us to conclude. We prove the result by induction on the number of saturation steps of Init(ϕ) =⇒ * K.

Base case. It is clear that all deduction statements f ∈ Init(ϕ) are either of type 1 or type 2.

Inductive case. We assume that the result holds for K and show that any possible application of a saturation rule preserves the result. We summarize the case analysis in the following two matrices. Addition. The following convergent equational theory E add is a simple model of addition introduced and proved decidable in [2]:

Narrowing

Inductive case. We assume that the result holds for K and we show that any possible application of a saturation rule preserves the result. We summarize the case analysis in the following two matrices. To show item 2 and 3, it remains to be proven that m f and m e strictly decrease after an antecedent of an unsolved statement is solved. An antecedent can only be solved by statements of type 1, 2 or 3. We show the result by a case analysis.

Narrowing

Let

f 1 = k(R, t) ⇐ k(X 1 , t 1 ), . . . , k(X n , t n ) .
• If the solved statement is of type 1 or 2, the proof is similar to the reasoning done in Lemma 4.8.

• It is easy to see that a solved statement of type 3 cannot be used to solved an antecedent of an unsolved statement (types 4-6). Indeed, the antecedents which are not variables, are either zero or a term of the form s(x) and hence unification is impossible.

Let f = i(U, V ) ⇐ k(X 1 , t 1 ), . . . , k(X n , t n )
• If the solved statement is of type 1 or 2, the proof is similar to the reasoning done in Lemma 4.8.

• A solved statement of type 3 can be used to solve an antecedent of the form k(X, t) when t is headed with the symbol plus. It is easy to see (since we already know the form of the deduction statements) that the only terms t occurring in an antecedent of an equational statement and headed with plus are ground. This allows us to conclude that the measure m e decreases also in this case.

Going Beyond with Fair Strategies

In [2] decidability is also shown for a theory modeling homomorphic encryption. For our procedure to terminate on this theory we use a particular saturation strategy.

Homomorphic encryption. The theory E homo of homomorphic encryption that has been studied in [2,[START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF] is as follows:

fst(pair(x, y)) = x snd(pair(x, y)) = y dec(enc(x, y), y) = x enc(pair(x, y), z) = pair(enc(x, z), enc(y, z)) dec(pair(x, y), z) = pair(dec(x, z), dec(y, z))

In general, our algorithm does not terminate under this equational theory. Consider for instance the frame ϕ = {w 1 → pair(a, b)} where a, b ∈ N are private names. We have that:

Init(ϕ) ⊇ { k(w 1 , pair(a, b))}, k(enc(X, Y ), enc(x, y)) ⇐ k(X, x), k(Y, y) }.
As in Example 4.11 we can obtain an unbounded number of solved statements whose projections are of the form: pair(enc(. . . enc(a, z 1 ) . . . , z n ), enc(. . . enc(b, z 1 ) . . . , z n )) ⇐ z 1 , . . . , z n .

However, we can guarantee termination by using a fair saturation strategy. We say that a saturation strategy is fair if whenever a rule instance is enabled it will eventually be taken. Indeed in the above example using a fair strategy we will eventually add statements whose projections are k(fst(w 1 ), a) ⇐ and k(snd(w 1 ), b) ⇐ . Now the "problematic" statements described above become redundant and are not added to the knowledge base anymore. One may note that a fair strategy does not guarantee termination in Example 4.11 (intuitively, because the function g is one-way and a is not deducible in that example). Lemma 4.13. If the saturation strategy is fair the saturation process terminates for the equational theory E homo .

Proof. Orienting the five equations in E homo we obtain the following convergent term rewriting system R homo :

R1 fst(pair(x, y)) → x R2 snd(pair(x, y)) → y R3 dec(enc(x, y), y) → x R4 enc(pair(x, y), z) → pair(enc(x, z), enc(y, z)) R5 dec(pair(x, y), z) → pair(dec(x, z), dec(y, z))
For the purpose of this proof we extend the notion of extended subterm and define st ext + (t) to be the smallest set such that: We extend as usual st ext + to frames. We will show that the set st ext + (t) is finite for every term t. Note that s ∈ st ext + (t) iff t → * R homo ∪{f (x1,...,xn)→xi} 1≤i≤n s where f ∈ F ranges over all function symbols and where n is the arity of f . We will show that R homo ∪ {f (x 1 , . . . , x n ) → x i } 1≤i≤n is terminating. Indeed, let h(t) = {h 1 , . . . , h m } be the multiset containing the heights of all occurrences of the function symbols enc and dec in the term t. We write h(s) ≺ h(t) if h(s) is smaller, in the multiset extension of the usual ordering on natural numbers, than h(t). We have that t → R homo ∪{f (x1,...,xn)→xi} 1≤i≤n s implies (h(s), |s|) < (h(t), |t|) where < is the well-founded lexicographic order with the multiset ordering ≺ on the first component and the usual order on natural numbers on the second component. As R homo ∪ {f (x 1 , . . . , x n ) → x i } 1≤i≤n is terminating and (obviously) finitely branching, it follows immediately that the set

st ext + (t) = {s | t → * R homo ∪{f (x1,...,xn)→xi} 1≤i≤n s} is finite.
Let ϕ be the frame being saturated. We first show that for all knowledge bases K such that Init(ϕ) =⇒ * K we have that each f ∈ { f | f ∈ K and f is a deduction statement} has one of the following forms: • C is obtained by arbitrarily nesting the following (classes of) contexts: C 1 = enc( , z i ), C 2 = dec( , z i ), and C 3 = pair( , ), where z i are variables.

• C ′ [t 1 , . . . , t k ] ∈ st ext + (φ)
, where C ′ is obtain from C by replacing enc( , z i ) and dec( , z i ) with .

• s i are ground terms

We show this by induction on the number of saturation steps of Init(ϕ) =⇒ * K. In the following when a projection f corresponds to one of the above 14 cases, we say that f is of type i (1 ≤ i ≤ 14). Base case. It is easy to see that all f ∈ Init(ϕ) are indeed of types 1 -6. Inductive case. We assume that the result holds for K and we show that any possible application of a saturation rule preserves the result. We summarize the case analysis in the following two matrices. We next show that because the strategy is fair at a given saturation step, no more statements of type 7 are added.

Narrowing

Lemma 4.14. Suppose that the saturation strategy is fair and let

Init(ϕ) =⇒ * K 0 =⇒ . . . =⇒ K i =⇒ . . . be a sequence of saturation steps. If f = C[t 1 , . . . , t k ] ⇐ s 1 , . . . , s l , Var (C) ∈ { f | f ∈ K 0 is
a deduction statement} is of type 7 or type 14 and k(R j , s j ) ∈ deriv(K 0 | solved ) for some R j for all j, then there exists n such that k(T i , t i ) ∈ deriv(K n | solved ) for some T i for all i.

Proof. The proof is done by induction on the number of saturation steps of Init(ϕ) ⇒ * K 0 . Base case. As Init(ϕ) does not contain any statements of type 7 or 14 we conclude. Inductive case. We suppose that the result holds for K 0 and verify that it is maintained by any possible rules that add a statement of type 7 or 14.

• Suppose we add a statement of type 7 by using rule Narrowing on a statement of type 7 in K 0 and R1 or R2. The rewriting must occur at a position in one of the t i which is rewritten to t ′ i . By induction hypothesis we have that there exists n, such that k(T i , t i ) ∈ deriv(K n | solved ). We can adapt the proof of Proposition 4.2 to show that because of fairness (rather than saturation) narrowing must be applied such that there exists n ′ such that k(T ′ i , t ′ i ) ∈ deriv(K n ′ | solved ) for some T ′ i .

• Suppose we add a statement of type 7 by using rule Narrowing on a statement of type 7 in K 0 and R3. If narrowing is applied on one of the t i the case is similar to the previous one. If narrowing is applied inside the context such that the t i do not change we conclude by induction hypothesis.

• Suppose we add a statement of type 14 by using rule Narrowing on a statement of type 7 in K 0 and R3. Narrowing must have changed both the context and one of the t i . Suppose w.l.o.g. i = 1. It must be that be that t 1 = enc(t ′ 1 , t ′′ 1 ). We have to show that there exists

n such that if k(T ′′ 1 , t ′′ 1 ) ∈ deriv(K n | solved ) for some T ′′ i then k(T ′ 1 , t ′ 1 ) ∈ deriv(K n | solved ) for some T ′ 1 and k(T i , t i ) ∈ deriv(K n | solved ) for some T i for all 2 ≤ i ≤ k. k(T i , t i ) ∈ deriv(K n | solved ) is obtained by induction hypothesis. If k(T ′′ i , t ′′ i ) ∈ deriv(K n | solved ) and because k(S 1 , enc(t ′ 1 , t ′′ 1 )) ∈ deriv(K n | solved ) we can apply Narrowing such that k(S ′ 1 , t ′ 1 ) ∈ deriv(K n ′ | solved ) for some n ′ .
• Suppose we add a statement of type 7 by using rule Narrowing on a statement of type 7 in K 0 and R4 (or analogously R5). If narrowing is applied on one of the t i the case is similar to previous cases. If narrowing is applied inside the context such that the t i do not change we conclude by induction hypothesis. Suppose both the context and one of the t i change. We suppose w.l.o.g. that i = 1. It must be that t 1 = pair(t ′ 1 , t ′′ 1 ). By induction hypothesis we have that there exists n such that k(T i , t i ) ∈ deriv(K n | solved ) for some T i for all 2 ≤ i ≤ k. As k(S 1 , pair(t ′ 1 , t ′′ 1 )) ∈ deriv(K n | solved ) for some S 1 we also have that k(fst(S 1 ), fst(pair(t ′ 1 , t ′′ 1 ))) ∈ deriv(K n | solved ) and k(snd(S 1 ), snd(pair(t ′ 1 , t ′′ 1 ))) ∈ deriv(K n | solved ). Because of fairness Narrowing can be applied such that k(fst(S 1 ), t ′ 1 ) ∈ deriv(K n ′ | solved ) and k(snd(S 1 ), t ′′ 1 ) ∈ deriv(K n ′′ | solved ) for some n ′ and n ′′ .

• Suppose we add a statement of type 7 by using rule F-Solving on statements of type 11 and 1 in K 0 . Let pair(t 1 , t 2 ) be the statement of type 1. As the strategy is fair we will add statements x ⇐ pair(x, y) and y ⇐ pair(x, y) by applying rule Narrowing on type 2/R1 and type 3/R2. Again by fairness we will apply solving on pair(t 1 , t 2 ) and x ⇐ pair(x, y) as well as y ⇐ pair(x, y) . Therefore t 1 and t 2 will be generated.

• Suppose we add a statement of type 7 by using rule F-Solving on statements of type 12 and 1 in K 0 . This case is similar to the previous one.

• Suppose we add a statement of type 7 by applying rule F-Solving on statements of type 8-12 with a statement of type 7 in K 0 . The resulting statement is a context on the same (or a subset of the) terms t i (1 ≤ i ≤ k) as the initial type 7 statement. We conclude by induction hypothesis.

• Suppose we add a statement of type 7 by applying rule F-Solving on a statement of type 14 with a statement of type 1 in K 0 . The type 14 statement has only one ground antecedent s 1 which is solved by the type 1 statement. Hence

s 1 ∈ { f | f ∈ K 0 , f deduction statement}
and k(S 1 , s 1 ) ∈ deriv(K 0 | solved ) for some S 1 . We can apply the induction hypothesis and conclude.

• Suppose we add a statement of type 14 by applying rule F-Solving on a statement of type 14 with a statement of type i (1 ≤ i ≤ 14) in K 0 . We directly conclude by induction hypothesis.

There are a finite number of solved statements other than of type 7. There exist only a finite number of t i which can occur in statements of type 7 as they are in st ext + (ϕ). Hence it follows from Lemma 4.14 that for any fair saturation sequence, at some moment all new statements of type 7 become redundant and therefore are not added to the knowledge base. Therefore any fair saturation sequence only contains a finite number of solved statements.

We know that after some number n of saturation steps, no more solved deduction statements are added to the knowledge base. We now show that a finite number of unsolved statements are added after this stage. Indeed, after n iterations, as no more solved statements are added to the knowledge base, the only types of statements potentially added are 13 and 14. The antecedents of these statements contain only ground terms or variables. By solving one of the ground antecedents the cardinality of the antecedents decreases ensuring termination.

We show that all equational statements are of the form i(M, N ) ⇐ k(X 1 , t 1 ), . . . , k(X k , t k ) , for some M, N where either t i ∈ X or t i = C[s 1 , . . . , s l ] for some ground terms s j (1 ≤ j ≤ l) and for some context C obtained by arbitrary nesting of contexts C 1 = enc( , z n ), C 2 = dec( , z n ), C 3 = pair( , ) and C 4 = , where z n are variables. This is true for the equational statements obtained by rule Unifying. When applying rule E-Solving on an antecedent of the above type we consider the following cases:

• if we solve k(X i , t i ) with a type 1 statement, we easily conclude;

• if we solve k(X i , t i ) with a statement of type 2, 3, 4, 5, 6, the result is immediate;

• if we solve k(X i , t i ) (where t i = C[s 1 , . . . , s l ]) with a type 7 statement C ′ [u 1 , . . . , u m ] ⇐ Var (C ′ ) , we note that mgu(t i , C ′ [u 1 , . . . , u m ]
) is such that variables are mapped to either variables or ground terms. Therefore the property holds.

Using again the measure

m e ( i(M, N ) ⇐ k(X 1 , t 1 ), . . . , k(X k , t k ) ) = (|Var (t 1 , . . . , t k )|, |t 1 | + . . . + |t k |)
and the lexicographic order < e on pairs, we obtain that f 0 < e f 1 for all f 0 and f 1 as in rule E-Solving.

Tool Support

With certain optimizations described below, our saturation algorithm runs in polynomial time for subterm convergent equational theories, E mal , E blind , and E tdcommit .

Optimizations

Optimization 4.1 (Deciding derivations in polynomial time)). To decide if k(R, t) ∈ deriv(K| solved ), the recursive algorithm obtained immediately from the deriv rules is not polynomial. However, by using memoization, its complexity becomes polynomial. Using the same trick, we can compute a recipe R such that k(R, t) ∈ deriv(K| solved ) in polynomial time, if we store R in DAG form.

Optimization 4.2 (Recipes in DAG form). Indeed, recipes might grow to an exponential size if they are not stored in DAG form. Therefore, we require that the term R in k(R, u) ⇐ ∆ and the terms U and V in k(U, V ) ⇐ ∆ are stored in DAG form.

Optimization 4.3 (Optimization to solve ground antecedents). Using different combinations of solved statements to solve ground antecedents is unnecessary work. Therefore we consider that the standard F-Solving and E-Solving rules are applied only when the antecedent being solved contains at least one variable. To solve an antecedent of the form k(X, t) when t is ground, we use the two rules described below. Again, as for ⊕, we suppose that the choice of recipes N and M is uniform. Lemma 4.15 (soundness of the two additional rules). Let ϕ be a frame and let K be a saturated knowledge base such that every statement in K holds in ϕ. Let f 1 and f 0 be two statements as in rules F-Solving' (resp. E-Solving'). If f 1 holds in ϕ then f 0 holds in ϕ.

F-Solving'

f 1 = k(M, t) ⇐ k(X 0 , t 0 ), . . . , k(X k , t k ) , Var (t 0 ) = ∅ k(N, t 0 ) ∈ deriv(K| solved ), Var (N ) ∩ Var (f 1 ) = ∅ (K, K| solved ) =⇒ K ⊕ f 0 where f 0 = k(M {X 0 → N }, t) ⇐ k(X 1 , t 1 ), . . . , k(X k , t k ) . E-Solving' f 1 = i(U, V ) ⇐ k(Y, s), k(X 1 , t 1 ), . . . , k(X k , t k ) ∈ K| solved , Var (s) = ∅ k(M, s) ∈ deriv(K| solved ), Var (M ) ∩ Var (f 1 ) = ∅ (K, K| solved ) =⇒ K ∪ {f 0 }) where f 0 = i(U {Y → M }, V {Y → M }) ⇐ {k(X i , t i )} 1≤i≤k .
Lemma 4.4. Let K be a saturated knowledge base and f = i(U, V ) ⇐ k(X 1 , t 1 ), . . . , k(X k , t k ) be an equational statement in K. For any substitution σ grounding for {t 1 , . . . ,

t k } such that k(R ′ i , t i σ) ∈ deriv(K| solved ) for some R ′ i for all 1 ≤ i ≤ k, we have that k(R i , t i σ) ∈ deriv(K| solved ) for some R i for all 1 ≤ i ≤ k and K| solved |= i(U τ, V τ ) where τ = {X 1 → R 1 , . . . , X k → R k }.
Proof. By induction on k i=1 |t i σ|. We distinguish two cases:

1. f is a solved equational statement. The proof is as before.

2. f is an unsolved equational statement. In such a case, there exists t j such that t j ∈ X . Let us assume w.l.o.g. that j = 1. If t 1 is not ground, then the proof is as before.

If t 1 is ground and because K is saturated,

f 2 = i(U {X 1 → M }, V {X 1 → M }) ⇐ k(X 2 , t 2 ), . . . , k(X k , t k )
must be in K| solved by rule E-Solving', where M is such that k(M, t 1 ) ∈ deriv(K| solved ).

We can apply the induction hypothesis on the statement f 2 and the same substitution σ to obtain that there exist R i (i ≥ 2) such that k(R i , t i σ) ∈ deriv(K| solved ) and:

K| solved |= i(U, V ){X 1 → M }{X 2 → R 2 , . . . , X k → R k }.
We chose R 1 = M and we immediately obtain the conclusion.

Lemma 4.7. Let K be a saturated knowledge base. Let f = k(R, t) ⇐ k(X 1 , t 1 ), . . . , k(X k , t k ) be a deduction statement such that K ⊕ f = K. For any substitution σ grounding for {t 1 , . . . , t k } such that k(T ′ i , t i σ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k, we have that there exist R 1 , . . . , R k and W such that • k(W, tσ) ∈ deriv(K| solved ), and k(R i , t i σ) ∈ deriv(K| solved ) for all 1 ≤ i ≤ k;

• K| solved |= i(W, R{X 1 → R 1 , . . . , X k → R k }).
Proof. By induction on k i=1 |t i σ|. We distinguish two cases. If f is solved, the proof is as before. If f is not solved, there exists j such that t j ∈ X . We assume w.l.o.g. that j = 1. If t 1 contains at least one variable, the proof is as before.

Otherwise, if t 1 is ground and because K is saturated, rule F-Solving' must have been applied and therefore we can apply the induction hypothesis on

f 2 = k(R{X 1 → N }, t) ⇐ k(X 2 , t 2 ), . . . , k(X k , t k )}
(where N is such that k(N, t 1 ) ∈ deriv(K| solved )) and on the same substitution σ to obtain that there exist R i (i ≥ 2) and W such that

• k(W, tσ) ∈ deriv(K| solved ) and k(R i , t i σ) ∈ deriv(K| solved ), for 2 ≤ i ≤ k • K| solved |= i(R{X 1 → N }{X 2 → R 2 , . . . , X k → R k }, W )
We choose R 1 = N and we immediately obtain our conclusion.

Complexity

Theorem 4.2. Using the optimizations 4.3, 4.2 and 4.1 described above, and if ϕ is in normal form, the saturation algorithm terminates in polynomial time for any subterm convergent equational theory, for E tdcommit , for E mal and for E blind .

In the remaining, we consider an equational theory E that is either subterm convergent, or E ∈ {E mal , E blind , E tdcommit }. We define the following set:

Q(ϕ) = { rσ ⇐ t 1 , . . . , t k }
for every rewrite rule l → r, for every partial substitution σ : Var (l) → st ext (ϕ) and for every set of incomparable positions p 1 , . . . , p k ∈ Pos(l) such that for every i (1 ≤ i ≤ k) we have that t i = (l| pi )σ.

In order to prove Theorem 4.2, we need an additional lemma.

Lemma 4.16. Let ϕ be a frame and let K be such that Init(ϕ) =⇒ * K. For any unsolved deduction statement f ∈ K we have that f ∈ Q(ϕ).

Proof. First, note that an unsolved deduction statement obtained by applying Narrowing on a solved statement satisfies this property. Now assume we have an unsolved deduction statement f = rσ ⇐ (l| p1 )σ, . . . , (l| p k )σ ∈ Q(ϕ) and assume one of its antecedents (l| pi )σ is being solved. Assume w.l.o.g. that i = 1.

• If (l| p1 )σ is ground, rule F-Solving' must be applied. We therefore obtain a statement f ′ = rσ ⇐ (l| p2 )σ, . . . , (l| p k )σ .

• If (l| p1 )σ is not ground, rule F-Solving is applied and l| p1 is necessarily not a variable (by the definition of σ, it maps variables only to ground terms). Therefore l| p1 is of the form g(s 1 , . . . , s l ) for some function symbol g ∈ F. We distinguish three cases:

-If the antecedent is solved using a deduction statement whose projection is of the form t ⇐ for some t ∈ st ext (ϕ), let σ ′ = mgu((l| p1 )σ, t) and consider τ = σσ ′ . By rule F-Solving, the antecedent (l| p1 )σ will simply be removed.

-If the antecedent is solved using a statement whose projection is g(x 1 , . . . , x l ) ⇐

x 1 , . . . , x l , then the antecedent (l| p1 )σ will be replaced by antecedents (l| p1•j )σ, for 1 ≤ j ≤ l.

-If the antecedent is solved using a "special" statement sign(t, x) ⇐ x (with t ∈

st ext (ϕ)), enc(x, t) ⇐ x (with t ∈ st ext (ϕ)), tdcommit(t 1 , t 2 , t 3 ) ⇐ (with t 1 , t 2 , t 3 ∈ st ext (ϕ)) or f(t 1 , t 2 , t 3 , x) ⇐ x (with t 1 , t 2 , t 3 ∈ st ext (ϕ))
, we obtain by a case-by-case analysis that the property is satisfied by the resulting statement. Now, we are able to prove Theorem 4.2

Proof. (of Theorem 4.2)

We first show that any knowledge base contains a polynomial number of deduction statements. Indeed, there are a polynomial number of solved deduction statements. Furthermore, from Lemma 4.11, Lemma 4.10, Lemma 4.9 and Lemma 4.8, we can deduce that the term in the head of each such solved deduction statement has polynomial size. As each Narrowing rule is applied at most once for each rewrite rule and each position of the term in the head of a solved deduction statement, applying rule Narrowing yields a polynomial number of unsolved deduction statements. We also know, thanks to Lemma 4.16, that for any frame ϕ (in normal form), for any knowledge base K reachable from Init(ϕ), and for any unsolved statement f ∈ K, we have that f ∈ Q(ϕ).

We consider the two following orders:

• the order < p defined on sets of positions as follows: {p 0 , . . . , p ℓ } < p {q 1 , . . . , q k , p 1 , . . . , p ℓ } iff q 1 , . . . , q k are incomparable positions and p 0 is a prefix of q i (1 ≤ i ≤ k).

• the order < f defined on deduction statements whose projection are in Q(ϕ):

f 0 < f f 1 iff either ℓ < k or ℓ = k and {p 1 , . . . , p k } < p {p ′ 1 , . . . , p ′ ℓ }.
where and where

f 0 = k(R, rσ) ⇐ k(X 1 , l| p1 σ), . . . , k(X k , l| p k ) ,
f 1 = k(R ′ , rσ ′ ) ⇐ k(X 1 , l| p ′ 1 σ ′ ), . . . , k(X l , l| p ′ ℓ σ ′ ) .
As < f does not depend on the frame, all strictly decreasing sequences of deduction statements have at most a constant size. Also note that if f 1 and f 0 are as in rule F-Solving or F-Solving', we have that

f 0 < f f 1 .
There is at most a polynomial number of choices to be made when solving each deduction statement (which antecedent, which solved deduction statement). As the resulting statements will be smaller (according to < f ) than the initial statement, and as any such sequence has at most a constant length, an unsolved statement will generated at most a polynomial number of statements.

We now show that each deduction statement has at most a polynomial size if the recipes are stored in DAG form. This is obviously true of the initial statements. The other recipes are obtained from the initial recipes by applying a polynomial number of substitutions whose size is polynomially bounded. Therefore all recipes have polynomial size.

It remains to show that there are a polynomial number of equational statements. This is true of the (necessarily solved) equational statements added during application of Narrowing and F-Solving (via the ⊕ operation). The other possibility to generate equational statements is Unifying, which generates a polynomial number of (possible unsolved) equational statements. All such unsolved equational statements have antecedents which are either ground or variables. Therefore, each such unsolved equational statement will lead to at most a polynomial number of other equational statements by applying rule E-Solving'.

Conclusion and Further Work

In this chapter, we have presented a procedure for checking static equivalence under convergent term rewriting systems. The procedure terminates and is therefore an algorithm when the term rewriting system implements one of the following (classes) of equational theories: subterm convergent, blind signatures, trapdoor commitment schemes, homomorphic encryption.

A C++ implementation of the procedures described in this paper is provided in the KiSs (Knowledge in Security protocols) tool [45].

The tool implements a partially fair saturation strategy and a uniform ⊕. The fairness employed by the tool is sufficient to decide the theory E homo . Moreover the tool implements the optimizations described in Section 4.7.1. This makes the procedure terminate in polynomial time for subterm convergent equational theories, and the theories E blind , E mal and E tdcommit .

The performances of the tool are comparable to the YAPA tool [START_REF] Baudet | YAPA (Yet Another Protocol Analyzer)[END_REF][START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF] and on most examples the tool terminates in less than a second. In [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF] a family of contrived examples is presented to diminish the performance of YAPA, exploiting the statement that YAPA does not implement DAG representations of terms and recipes, as opposed to KiSs. As expected, KiSs indeed performs better on these examples.

Regarding termination, our procedure terminates on all examples of equational theories presented in [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF]. In addition, our tool terminates on the theories E mal and E tdcommit whereas YAPA does not. In [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF] a class of equational theories for which YAPA terminates is identified and it is not known whether our procedure terminates. YAPA may also terminate on examples outside this class. Hence the question whether termination of our procedures encompasses termination of YAPA is still open.

As further work, it would be interesting to extend the range of equational theories handled by the tool. In particular, associative-commutative function symbols should be handled in order to model exclusive-or. Another direction for future work is to extend the technique in order to handle the active case. This direction is taken in Chapter 5.

Chapter 5

Automated Verification of Trace Equivalence

Introduction

When security protocols are verified in a formal setting, the most usual security property that is checked is secrecy of some data. To check secrecy of some value s, the security protocol is modeled as a mathematical object P in some formalism such as the process algebra. Then, by using automated methods, hand-made proofs, or a combination of the two, it is proven that either the protocol preserves the secrecy of s in the chosen formalism, or we find an attack, i.e. a series of intruder actions that lead to the discovery of s.

Secrecy is a trace property, in the sense that it is sufficient to analyze each trace of the protocol in turn and check if the trace leaks s or not. Another important trace property is authentication, which is usually modeled as an implication of the form: Any time an event E takes place (e.g. a request for a money transfer has been sent to the bank), it must be the case that a previous event E ′ also took place (i.e. the credentials for the bank account were sent to the bank).

There are by now a large number of theoretical results [START_REF] Cremers | Unbounded verification, falsification, and characterization of security protocols by pattern refinement[END_REF][START_REF] Rusinowitch | Protocol insecurity with finite number of sessions and composed keys is NP-complete[END_REF][START_REF] Chevalier | Combining intruder theories[END_REF][START_REF] Chevalier | An NP decision procedure for protocol insecurity with XOR[END_REF][START_REF] Chevalier | Deciding the security of protocols with Diffie-Hellman exponentiation and product in exponents[END_REF][START_REF] Comon-Lundh | Intruder deductions, constraint solving and insecurity decision in presence of exclusive or[END_REF]8,[START_REF] Bursuc | Protocol security and algebraic properties: Decision results for a bounded number of sessions[END_REF] regarding the automated verification of secrecy and authentication properties. Furthermore, a number of automated tools [START_REF] Cremers | The Scyther Tool: Verification, falsification, and analysis of security protocols[END_REF]12,[START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF][START_REF] Escobar | Maude-NPA: Cryptographic protocol analysis modulo equational properties[END_REF] are available to automatically check such properties.

However, while secrecy and authentication are certainly important, they are not sufficient, in the sense that there exist security protocols of which we expect more. Many crucial security properties can only be expressed in terms of indistinguishability (or equivalence).

In particular, it is usually important for electronic voting protocols to preserve vote privacy, in the sense that an attacker (who might be one of the election organizers) should not be able to link voters to their vote. Informally, we would like to say voting protocol satisfies vote privacy if an attacker cannot find out how any given person voted. It turns out however that this requirement is too strong: for example, in an election where there is unanimity, everyone knows how everyone voted as soon as the result is announced.

Kremer, Delaune and Ryan propose another definition [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. Let P {v A → X, v B → Y } be an instance of the voting protocol where voter A voted for some candidate X (modeled by the fact that v A = X) and where voter B voted for candidate Y . We can then say that the voting protocol satisfies vote privacy if the attacker cannot distinguish this situation from the situation where A and B swap their votes:

P {v A → X, v B → Y } ≈ t P {v A → Y, v B → X}.
Here the symbol ≈ t denotes an indistinguishability relation between processes, i.e. ≈ t identifies processes which look the same to the intruder. In this thesis, we will assume that ≈ t is trace equivalence, as it best models the capabilities of the standard Dolev-Yao attacker, which has complete control of the network and no control whatsoever of the machines belonging to the honest participants.

Other uses of indistinguishability include strong flavors of confidentiality [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF]; resistance to guessing attacks in password based protocols [START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF]; and anonymity properties in private authentication protocols [4], electronic voting [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF][START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF], vehicular networks [START_REF] Dahl | Formal analysis of privacy for vehicular mix-zones[END_REF][START_REF] Dahl | Formal analysis of privacy for anonymous location based services[END_REF] and RFID protools [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF][START_REF] Bruso | Analysing unlinkability and anonymity using the applied pi calculus[END_REF]. More generally, indistinguishability allows to model security by the means of ideal systems, which are correct by construction [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF][START_REF] Delaune | Simulation based security in the applied pi calculus[END_REF]. Indistinguishablity properties of cryptographic protocols are naturally modeled by the means of observational and testing equivalences in cryptographic extensions of process calculi, e.g., the spi-calculus [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF] and the applied-pi calculus [3].

While we have a good number of tools [START_REF] Cremers | The Scyther Tool: Verification, falsification, and analysis of security protocols[END_REF]12,[START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF][START_REF] Escobar | Maude-NPA: Cryptographic protocol analysis modulo equational properties[END_REF] for automated verification of trace properties, the situation is different for indistinguishability properties. This chapter addresses this situation by introducing a procedure for checking trace equivalence.

Related Work

In the case of a passive adversary, i.e. an adversary that only listens to messages on the network but cannot modify them, deciding trace equivalence reduces to checking static equivalence. As we have seen in the previous chapter, many decidability results have been obtained [2,[START_REF] Cortier | Deciding knowledge in security protocols for monoidal equational theories[END_REF][START_REF] Arnaud | Combining algorithms for deciding knowledge in security protocols[END_REF]. Exact [START_REF] Baudet | YAPA: A generic tool for computing intruder knowledge[END_REF][START_REF] Ciobâcȃ | Computing knowledge in security protocols under convergent equational theories[END_REF] and approximate [START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF] tools exist for a variety of cryptographic primitives.

The field of automated verification for equivalence properties is less well-developed. There are a few theoretical results [START_REF] Hüttel | Deciding framed bisimilarity[END_REF][START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF][START_REF] Cortier | A method for proving observational equivalence[END_REF][START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF][START_REF] Tiu | Automating open bisimulation checking for the spi calculus[END_REF] and very few tools [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF][START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF] that can handle equivalence properties. Undecidability of observational equivalence in the spi calculus, even for the finite control fragment, was shown by Hüttel [START_REF] Hüttel | Deciding framed bisimilarity[END_REF]. Current results [START_REF] Blanchet | Automated Verification of Selected Equivalences for Security Protocols[END_REF] allow to approximate observational equivalence for an unbounded number of sessions. However, this approximation does not suffice to conclude for many applications, such as electronic voting protocols.

For the finite, replication-free, fragment of the spi calculus a decision result [START_REF] Hüttel | Deciding framed bisimilarity[END_REF] and an automated tool [START_REF] Durante | Automatic testing equivalence verification of spi calculus specifications[END_REF] exist for checking observational equivalence, but only for a fixed, limited set of cryptographic primitives. Symbolic bisimulations have also been devised for the spi [START_REF] Borgström | Symbolic bisimulation in the spi calculus[END_REF][START_REF] Borgström | Equivalences and Calculi for Formal Verifiation of Cryptographic Protocols[END_REF] and applied pi calculus [START_REF] Delaune | Symbolic bisimulation for the applied pi calculus[END_REF][START_REF] Liu | A complete symbolic bisimulation for full applied pi calculus[END_REF] to avoid unbounded branching due to adversary inputs. However, only [START_REF] Delaune | Symbolic bisimulation for the applied pi calculus[END_REF] and [START_REF] Borgström | Symbolic bisimulation in the spi calculus[END_REF] yield a decision procedure, but again only approximating observational equivalence. The results of [START_REF] Delaune | Symbolic bisimulation for the applied pi calculus[END_REF] have been further refined to show a decision procedure on a restricted class of simple processes [START_REF] Cortier | A method for proving observational equivalence[END_REF]. In particular they rely on a procedure deciding the equivalence of constraint systems, introduced by Baudet [START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF], for the special case of verifying the existence of guessing attacks. Baudet's procedure allows arbitrary cryptographic primitives that can be modeled as a subterm convergent rewrite systems. An alternate procedure achieving the same goal was proposed by Chevalier and Rusinowitch [START_REF] Chevalier | Decidability of equivalence of symbolic derivations[END_REF]. However, both procedures are highly nondeterministic and do not yield a reasonable algorithm which could be implemented. Therefore, Cheval et al. [START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF][START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF] have designed a new procedure and a prototype tool to decide the equivalence of constraint systems, but only for a fixed set of primitives. In particular, [START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF] decides equivalence of two symbolic traces and an implementation is available. In [START_REF] Cheval | Trace equivalence decision: Negative tests and non-determinism[END_REF], the same authors extend [START_REF] Cheval | Automating security analysis: symbolic equivalence of constraint systems[END_REF] to handle equivalence between nondeterminate processes with else branches, but the resulting algorithm is not (yet) implemented and is limited by the fact that it cannot treat cryptographic primitives appearing in electronic voting protocols.

Techniques based on Horn clauses have been extensively used, e.g. by Blanchet [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF], Weidenbach [START_REF] Weidenbach | ]) for all 1 ≤ i ≤ n -1. By Lemma A.19, we have that can(l i σ) ≃ can(r i σ). By Corrolary A.3, we[END_REF] and Goubault [START_REF] Goubault-Larrecq | Deciding H 1 by resolution[END_REF], in the case of an unbounded number of sessions. However, all these approaches allow false attacks. In the case of confidentiality properties, precise encodings (without false attacks) into Horn clauses have been proposed and implemented in [6]. However, the encoding is for a fixed set of cryptographic primitives, it does not take into account that processes may block (due to a test failing) and it works only for trace properties. Another approach [START_REF] Delaune | Protocol verification via rigid/flexible resolution[END_REF] based on resolution of clauses with rigid variables was proposed to solve reachability properties while avoiding false attacks.

Contribution

In this chapter we introduce an automated method for proving trace equivalence for a cryptographic process algebra without replication and without else branches where messages are modeled as terms equipped with an equational theory, similar to the applied pi calculus [3]. We define our process algebra in Section 5.2. Our approach is based on modeling traces as Horn clauses and can be seen as an extension of the procedure presented in Chapter 4. We give an informal overview of the procedure and we present the main difficulties in modeling traces as sets of Horn clauses in Section 5.3.

In Section 5.4, we formalize the modeling of traces into Horn clauses and in Section 5.5, we formally describe the saturation procedure applied to the set of Horn clauses. The goal of the saturation procedure is to produce a set of Horn clauses which make it easy to check trace equivalence. It is correct for arbitrary cryptographic primitives that have the strong finite variant property. We prove this by showing soundness (Section 5.6) and completeness (Section 5.7) of the saturation procedure. Due to the highly complex form of Horn clauses appearing during saturation, we were not able to prove that saturation always terminates. We conjecture that it always terminates when the rewrite system is subterm convergent.

In Section 5.5.3 we show how to decide coarse trace equivalence from the saturated sets of Horn clauses for the class of determinate processes. For this class of processes, we show (Section 5.2.3) that coarse trace equivalence coincides with trace equivalence. Furthermore, we know that for determinate processes, trace equivalence is the same as observational equivalence [START_REF] Cortier | A method for proving observational equivalence[END_REF]. The proof that the algorithm given in Section 5.5.3 for deciding coarse trace equivalence for determinate processes is correct is given in Section 5.8. To overcome the limitation of determinate processes, we suggest a proof method in Section 5.9 for showing trace equivalence for processes which are not known to be determinate. Using this proof method, we give an automated proof of vote privacy for the electronic voting protocol FOO in Section 5.9.3.

We have implemented the saturation procedure and the trace equivalence checking algorithm in the tool AKiSs [46]. We describe our implementation in Section 5.9. We conclude and present directions for further work in Section 5.10. This chapter is based on an article that has been published in [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF].

Process Algebra

In order to formally assess the security of cryptographic protocols, it is necessary to model the protocols and the expected security properties as mathematical objects. Cryptographic process calculi [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF]3] are a formalism derived from generic process calculi [START_REF] Milner | Communicating and mobile systems: the π-calculus[END_REF] that are designed specifically for modelling cryptographic protocols. In this thesis, we introduce a version of the applied pi calculus [3] that is particularly ammenable to automated analysis and to composability issues discussed in this thesis. Recall that we have fixed a first-order signature F, a set N of private names, a set M of public names, a set C of public channels, and a set W of parameters. Processes are built from atomic building blocks that we call actions: The action receive(c, x) intuitively denotes the fact that a message is expected on channel c. When a message is received, it is bound to the variable x. The action send(c, t) represents an agent that sends out a message t on the cannel c. The action [s ?

Actions

= t] blocks if the terms s and t represent different messages and executes successfully otherwise.

Traces

During a protocol run, actions are performed concurrently by the agents running the protocol. Intuitively, T = a 1 .a 2 . . . . .a n represents an agent which first performs the action a 1 , then a 2 , etc. As usual, a receive action a i = receive(c, x) acts as a binding construct for the variable x in the rest of the trace a i+1 , . . . , a n . We assume the usual definitions of free and bound variables for traces. We also identify traces which are equivalent up to α-renaming of bound variables.

If T is a trace with free variables x 1 , . . . , x n , we write T (x 1 , . . . , x n ) instead of T . As is usual, T (m 1 , . . . , m n ) will then represent the trace T where the terms m 1 , . . . , m n are substituted for variables x 1 , . . . , x n such that variable-capturing is avoided.

Example 5.1. Let c be a public channel name, let k ∈ N be a private name representing a key and let T (x) = send(c, enc(x, k)).send(c, k).

The trace T (x) can represent the sequence of actions performed by a voter that wishes to vote x.

Semantics of traces

As is usual in security protocol analysis, we assume that all interactions between participants are mediated by the attacker. Therefore, whenever a participant is ready to send a message on a public channel, the attacker will be the one receiving the message, thereby increasing its knowledge. Similarly, every time an agent is ready to input a message from a public channel, it is the attacker that provides this message; the attacker will build it from its previous knowledge. This fact is modeled in the operational semantics of a trace. A trace executes in the presence of a frame representing the messages that have already been exchanged on the network. If the term l ∈ {receive(c, r), send(c), test} is over the signature F ⊎{receive, send, test} (with c ∈ C being a channel name and r ∈ T (F, W ∪ M) being a recipe), the relation l -→ F ,E denotes one execution step, and is defined as follows:

Receive ϕ ⊢ r F ,E t (receive(c, x).T, ϕ) receive(c,r) --------→ F ,E (T {x → t}, ϕ) Send (send(c, t).T, ϕ) send(c) -----→ F ,E (T, ϕ ∪ {w |Dom(ϕ)|+1 → t}) Test s = E t ([s ? = t].T, ϕ) test ---→ F ,E (T, ϕ)
When the signature F or the equational theory E are clear from context, we can drop them from the subscript and write

l - →, l - → E or l - → F instead of l - → F ,E .
The labels on the "-→ F ,E " arrow denote intuitively the actions performed by the attacker. If the trace expects a message on channel c, the intruder will construct using recipe r a term t from the terms currently known to the intruder (the terms in ϕ). Then the receive action is executed, the variable to which the message is bound being replaced in the rest of the trace by the message itself. The intruder knowledge does not increase and therefore no new term is added to the frame ϕ.

If the trace performs a send action, the message being sent goes to the intruder and is therefore added to the frame, modeling the fact that the intruder knowledge has grown. If the trace performs a test action, the test must be successful in order for the trace to continue. No new message is added to the frame in this case. If the test is not successful, the trace blocks. We write l1,...,ln ----------→ (0, ϕ)

----→ F ,E for l1 -→ F ,E l2 -→ F ,E . . .
where 0 denotes the empty trace (with 0 actions) and where ϕ = {w 1 → enc(yes, k), w 2 → k}.

As send and receive actions are mediated by the intruder, they are visible to the intruder. However, test actions test are internal to the trace and are not visible to the intruder. As is usual in process calculi, we define a weak semantics to account for the lack of visibility by the intruder of test actions. In this semantics test actions can be performed spontaneously or skipped. This weak semantics is defined by the relation = ⇒. We shall write (T, ϕ)

l = ⇒ (T ′ , ϕ ′ ) if 1. (T, ϕ) test * ,l,test * --------→ (T ′ , ϕ ′ ) when l = test and 2. (T, ϕ) test * ---→ (T ′ , ϕ ′ ) when l = test,
where test * denotes an arbitrary number of test actions.

Processes

Traces describe actions executing sequentially in a protocol. However, in a security protocol, a different sequences of actions might be performed depending on the choices of agents and of the intruder. To represent this, we define processes to consist of any number of traces. Definition 5.3. A process P is a set (possibly infinite) of traces.

The set of bound variables (resp. the set of free variables) of a process is the union of the sets of bound variables (resp. free variables) of all traces in the process. We identify processes which are equal up to α-renaming of bound variables. If {x 1 , . . . , x n } is the set of free variables of a process P , we write P (x 1 , . . . , x n ) instead of P . In this case P (m 1 , . . . , m n ) denotes the process P where the free variables x 1 , . . . , x n are replaced by the corresponding terms m 1 , . . . , m n in a variable-capture avoiding way. We identify singleton processes (consisting of a single trace) with the trace itself.

We write (P, ∅)

====⇒ (T, ϕ)

). Therefore, a process behaves as any one of its traces. This definition is non-standard, in the sense that cryptographic process calculi usual contain a parallel operator "|" (P | Q denoting two processes executing concurrently), a non-deterministic operator "+" (P + Q denoting a process which executes either as P or as Q) and a replication operator "!" (!P denoting the process that executes as an infinite number of copies of P in parallel).

However it is easy to see that any process defined using the parallel composition operator, the non-deterministic choice operator and the replication operator is trace equivalent to a process in our calculus (obtained by considering all possible interleavings of actions for each of the operators). Therefore, from a theoretical point of view, this choice of representation of processes is not a restriction, as illustrated by the following example:

Example 5.3. We consider a toy voting protocol where each agent sends the vote (either 'yes' or 'no'), encrypted with a previously distributed key k on a public channel. We assume without modeling this that a trusted authority will then collect all votes, decrypt them and announce the result.

We consider the trace S = send(c, enc(yes, k)).send(c, k) run by an agent voting 'yes' and then accidently (or maliciously) sending the key k on the network. The trace T = send(c, enc(no, k)) is that of an agent voting 'no'. Then the following process P = { send(c, enc(yes, k)).send(c, k).send(c, enc(no, k)), send(c, enc(yes, k)).send(c, enc(no, k)).send(c, k), send(c, enc(no, k)).send(c, enc(yes, k)).send(c, k) } consisting of three traces represents all possible concurrent runs of S and T running in parallel.

However, in practice, the representation of a process as a collection of traces might be exponentially larger than a representation using the usual operators. We choose to work with a collection of traces since the procedure that we describe in this chapter is easier to state on traces. However, we note that before applying this procedure to a security protocol, an exponential blow-up could occur due to the change in representation.

Determinate processes

An important class of processes is the class of determinate processes. The class of determinate processes was first introduced by Engelfriet [START_REF] Engelfriet | Determinacy -(observation equivalence = trace equivalence)[END_REF] for the π-calculus [START_REF] Milner | Communicating and mobile systems: the π-calculus[END_REF]. He showed that trace equivalence coincides with observational equivalence for this class of processes. Cortier and Delaune [START_REF] Cortier | A method for proving observational equivalence[END_REF] extended the result of Engelfriet to the applied π-calculus [3]. As the core of our procedure shows trace equivalence for determinate process, we need to formally define determinate processes for our calculus. Definition 5.4. A process P is determinate if whenever (P, ∅) l1,...,ln ====⇒ (T, ϕ) and (P, ∅) l1,...,ln

====⇒ (T ′ , ϕ ′ ) then ϕ ≈ s ϕ ′ .
Intuitively this means that whenever the intruder performs a sequence of visible actions, its knowledge is completely determined up to static equivalence by the sequence of actions that it performed. The following is immediate from the definition. Proposition 5.1. A trace (i.e. a process consisting of a single trace) is determinate.

Trace Equivalence

Security properties such as vote privacy can be defined in terms of equivalences between processes. We recall the standard definition of trace equivalence. Definition 5.5 (Trace equivalence). A process P is said to be trace-included in a process Q (written P ⊑ t Q) if whenever (P, ∅) l1,...,ln ====⇒ (T, ϕ) there exist T ′ , ϕ ′ such that (Q, ∅) l1,...,ln ====⇒ (T ′ , ϕ ′ ) and ϕ ≈ s ϕ ′ . Two processes P and Q are trace-equivalent (written

P ≈ t Q) if P ⊑ t Q and Q ⊑ t P .

Coarse Trace Equivalence and Determinate Processes

We now introduce an equivalence between processes that we call coarse trace equivalence and that is in general weaker than trace equivalence: two processes which are in trace equivalence are necessarily in coarse trace equivalence but not vice-versa. The reason for introducing this equivalence is that it is easier to reason about. Furthermore, we show here that the two notions of equivalence coincide for determinate processes. Definition 5.6. Given two processes P and Q, we say that P is coarse trace included in Q (and we write P ⊑ c Q) if whenever (P, ∅) l1,...,ln ====⇒ (T, ϕ) there exist T ′ , ϕ ′ such that (Q, ∅) l1,...,ln ====⇒ (T ′ , ϕ ′ ) and ϕ ⊑ s ϕ ′ . We say that P is coarse trace equivalent to P (and we write

P ≈ c Q) if P ⊑ c Q and Q ⊑ c P .
It is easy to see from the above definition that P ≈ t Q implies P ≈ c Q for any processes P and Q. The following example show that the reverse implication is not always true.

Clearly P ⊑ c Q. Observe also that Q ⊑ c P . This is because {w 1 → a, w 2 → b} ⊑ s {w 1 → a, w 2 → a}. Thus, P ≈ c Q. But P ≈ t Q.
The following theorem shows that the reverse implication is true if P and Q are determinate. Theorem 5.1. . If P and Q are determinate processes then P ≈ t Q iff P ≈ c Q.

Proof. Let P and Q be determinate processes.

(⇒) Follows immediately from definition of ≈ t and ≈ c .

(⇐) We need to show that that P ≈ c Q implies P ≈ t Q. We proceed by contradiction. Suppose that P ≈ c Q and P ≈ t Q. We suppose P ⊑ t Q (the case of Q ⊑ t P being symmetric). As P ⊑ t Q we have that there exist l 1 , . . . , l n , T , ϕ, such that (P, ∅) l1,...,ln ====⇒ (T, ϕ) and 1. either there exist no ϕ ′ , T ′ such that (Q, ∅) l1,...,ln

====⇒ (T ′ , ϕ ′ ), 2. or for all ϕ ′ , T ′ such that (Q, ∅) l1,...,ln ====⇒ (T ′ , ϕ ′ ) we have that ϕ ≈ s ϕ ′ .
In the first case, P ≈ c Q, contradicting our hypothesis. In the second case, as ϕ ≈ s ϕ ′ , there exist r, r ′ such that (r = r ′ )ϕ and (r = r ′ )ϕ ′ (or vice-versa, the other case is symmetric).

As P ⊑ c Q, we have that there exist T ′′ , ϕ ′′ such that (Q, ∅) l1,...,ln ====⇒ (T ′′ , ϕ ′′ ) and ϕ ⊑ s ϕ ′′ . Hence, we have (r = r ′ )ϕ ′′ . As Q is determinate, we have that ϕ ′ ≈ s ϕ ′′ . This yields a contradiction, as (r = r ′ )ϕ ′ and (r = r ′ )ϕ ′′ would imply ϕ ′ ≈ s ϕ ′′ .

Overview and Difficulties

Having already presented in Chapter 4 a successful procedure for static equivalence, we can try to extend it to handle trace equivalence. Unfortunately, a number of difficulties arise due to the active nature of the intruder.

Horn Clause Modeling

The most natural extension is to define an initial knowledge base for a symbolic trace. As in the previous chapter, the initial knowledge will be a Horn theory containing Horn clauses that we call statements. Such a knowledge base would contain the "context" statements which model that the intruder can apply function symbols to known terms. It would also contain statements modeling that the intruder knows all public names.

In addition to those statements, an initial knowledge base for a symbolic trace should also contain statements which model that if the intruder is able to provide inputs that pass the tests in the process, then whatever the process outputs enters the intruder knowledge. For example, consider the symbolic trace

P = send(c, enc(a, k)).receive(c, x).send(c, dec(x, k))
where a and k are private names and c ∈ C is a public channel. We could model this symbolic trace by the Horn clauses

k(w 1 , enc(a, k)) k(w 2 , dec(x, k)) ⇐ k(X, x),
where the k predicate is similar to the k predicate using for static equivalence in Chapter 4: the fact k(R, t) intuitively states that R can be used by the intruder as a recipe for t.

The first clause states that the intruder knows the encryption of a with k (as it is the first message sent by the process). The second clause models that if the intruder can construct a message x, then the second output of the trace (the parameter w 2 ) is a recipe for the decryption of x with the private name k. This allows us to conclude that a is not secret, since k(w 2 , a) can be derived by instantiating k(X, x) with k(w 1 , enc(a, k)) in the second Horn clause above. Unfortunately, this modeling is not accurate. Consider the following trace: T = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).send(c, dec(x, k)).

receive(c, y).[y ?

= pair(a, a ′ )].send(c, s).0 where a, a ′ , k, s ∈ N are private names and c is a public channel. This trace first outputs the encryption of a and respectively a ′ with the key k and then offers to make one decryption with the key k. The intruder can therefore choose to get either the private name a or the private name a ′ , but not both. After the decryption, the trace verifies if the intruder is able to provide a pair containing both a and a ′ and, if so, outputs the private name s. The above trace would be modeled as the following set of Horn clauses:

k(w 1 , enc(a, k)) k(w 2 , enc(a ′ , k)) k(w 3 , dec(x, k)) ⇐ k(X, x) k(w 4 , s) ⇐ k(X, x), k(Y, y), y = E pair(a, a ′ )).
The above set of Horn clauses, combined with the context statement that allows the intruder to construct pairs of known terms, allows to derive the fact k(w 4 , s). This is clearly not sound, since the protocol does not reveal s. The problem in the above modeling is that the protocol allows the intruder to decrypt exactly one message with the key k, while the Horn clauses allow the intruder to decrypt any number of such messages.

To solve this issue, we annotate the intruder knowledge predicate with additional parameters to take into account the entire history of interactions with the protocol. We write the new arguments as a subscript of k. To illustrate this, consider again the symbolic trace P = send(c, enc(a, k)).receive(c, x).send(c, dec(x, k))

where a and k are private names and c ∈ C is a public channel. We will model this trace using the following Horn clauses

k send(c) (w 1 , enc(a, k)) k send(c),receive(c,x),send(c) (w 2 , dec(x, k)) ⇐ k send(c) (X, x).
The first Horn clause now states that after one send action on channel c, the parameter w 1 points to the encryption of a with k. The second Horn clause states that if the intruder can construct a message x after one send action of the protocol, then after one send action, one receive action where x (the same x as before) is being input by the trace and another send action, the parameter w 2 points to the decryption of x with k. The fact that a is revealed is still modeled by the Horn clauses since k send(c),receive(c,enc(a,k)),send(c) (w 2 , a) is derivable. Furthermore, we now avoid the accuracy problems. Consider again the trace T = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).send(c, dec(x, k)).

receive(c, y).[y ?

= pair(a, a ′ )].send(c, s).0 where a, a ′ , k, s ∈ N are private names and c is a public channel. Using the new encoding, the above trace is modeled as the following set of Horn clauses:

k send(c) (w 1 , enc(a, k)) k send(c),send(c) (w 2 , enc(a ′ , k)) k send(c),send(c),receive(c,x),send(c) (w 3 , dec(x, k)) ⇐ k send(c),send(c) (X, x) k send(c),send(c),receive(c,x),send(c),receive(c,y),send(c) (w 4 , s) ⇐ k send(c),send(c) (X, x), k send(c),send(c),receive(c,x),send(c) (Y, y), y = E pair(a, a ′ )).
With the new encoding, we have that k send(c),send(c),receive(c,enc(a,k)),send(c) (w 3 , a) is derivable and also that k send(c),send(c),receive(c,enc(a ′ ,k)),send(c) (w 3 , a ′ ) is derivable. However, there exists no history H and no recipe R such that k H (R, pair(a, a ′ )) is derivable. We are assuming of course that context statements only allow to apply contexts over terms that can be obtained by the intruder using the same history. For example, the context statements modeling the fact that the intruder can pair up know terms should now be

k W (pair(X, Y ), pair(x, y)) ⇐ k W (X, x), k W (Y, y),
where W is a variable that matches the history and X, Y, x, y are regular variables.

A similar encoding was proposed for verifying secrecy properties [6] for a specific intruder theory. However, that encoding is not completely accurate as it does not take into account the fact that processes might block. Our encoding into Horn clauses is a full abstraction of the respective symbolic trace.

Getting Rid of Equational Antecedents

In the body of the Horn clauses above, we have introduced additional constraints of the form u = E v for some terms u, v. These antecedents appear because the process is performing some test [u ? = v]. Fortunately, there is an easy way to get rid of these antecedents by using complete set of unifiers. A complete set of unifiers modulo E of the terms u and v provides a finite symbolic representation of all instantiations of u and v which render the two terms equal modulo E. Therefore, we will simply replace a Horn clause of the form

C = H ⇐ B 1 , . . . , B n , u = E V with a set of Horn clauses C 1 = (H ⇐ B 1 , . . . , B n )σ 1 . . . C k = (H ⇐ B 1 , . . . , B n )σ k .
whenever σ 1 , . . . , σ k is a complete set of unifiers of u and v. Such a complete set of unifiers can be effectively computed using the procedure developed in Section 3.6 for any equational theory having the strong finite variant property. By the results in Chapter 3 all convergent optimally reducing equational theories have the strong finite variant property.

Termination

The goal of the saturation procedure is to produce by resolution a set of solved statements which is "equivalent" in some sense to the set of initial statements such that trace equivalence is easy to check from the solved set of statements. Unfortunately, if we naively extend the saturation procedure from Chapter 4, the saturation process will not terminate even in simple cases. We illustrate non-termination of saturation bellow. We consider the following subterm convergent rewrite system

R = {f (f (x)) → f (x)}
and the symbolic trace S = receive(c, x).send(c, f (x)).

We have that the Horn clause

k receive(c,x),send (w 1 , f (x)) ⇐ k(X, x)
is in the initial knowledge base of the symbolic trace. The fact that k(X, x) does not have any subscript indicates that the intruder must construct x using recipe X before any interaction with the process, i.e. in the empty history.

As an instantiation of f (x) might not be in normal form (depending on the value of x), there is a chance to perform a narrowing step on this clause using the (fresh) rewrite rule f (f (y)) → f (y). We would obtain the clause

k receive(c,f (y)),send (w 1 , f (y)) ⇐ k(X, f (y)).
The antecedent in the body of this Horn clause can be solved using a context fact and we would obtain the statement k receive(c,f (y)),send (w 1 , f (y)) ⇐ k(X, y).

Unfortunately, at this point we can perform another narrowing step of f (y) with the (fresh) rewrite rule f (f (z)) → f (z). As this would continue forever, the saturation procedure would have no chance to stop. Fortunately, there is a way to "precompute" all possible normal forms of the term f (x) using the strong finite variant property described in Chapter 3 and therefore not have to apply narrowing steps on the fly. In the initial knowledge base, we will basically replace Horn clauses of the form

C = k H (R, t) ⇐ B 1 , . . . , B n by a set of clauses C 1 = (k H (R, t))σ 1 ↓ ⇐ B 1 σ 1 ↓, . . . , B n σ 1 ↓ . . . C k = (k H (R, t))σ k ↓ ⇐ B 1 σ k ↓, . . . , B n σ k ↓ .
whenever σ 1 , . . . , σ k is a strongly complete set of variants of t. This replacement allows us to get rid of the equational theory entirely during the saturation process; as an immediate consequence it also fixes the non-termination problem in the above example.

Canonical Forms and the Reachability Predicate

A key ingredient of our procedure for deciding static equivalence were the canonical forms of the statements. The canonicalization rule Rename allowed us to "collapse" two recipe variables when the recipes pointed to the same term:

Rename k(R, t) ⇐ k(X 1 , x 1 ), . . . , k(X k , x k ) {i, j} ⊆ {1, . . . , n} j = i and x j = x i k(R{X i → X j }, t) ⇐ k(X 1 , x 1 ), . . . , k(X i-1 , x i-1 ), k(X i+1 , x i+1 ), . . . , k(X k , x k )
In the presence of the history arguments, things get more complicated. We could adapt the rule Rename to behave as follows:

k H (R, t) ⇐ k H1 (X 1 , x 1 ), . . . , k H k (X k , x k ) {i, j} ⊆ {1, . . . , n} j = i and x j = x i k H (R{X i → X j }, t) ⇐ k H1 (X 1 , x 1 ), . . . , k Hi-1 (X i-1 , x i-1 ), k Hi+1 (X i+1 , x i+1 ), . . . , k H k (X k , x k )
In all of the statements in any knowledge base, all history sequences H 1 , . . . , H k in the body of the clause are prefixes of the history H in the head of the clause and therefore H i and H j are one prefix of the other. If the two histories involved in the above canonicalization rule are equal (H i = H j ), then there is no problem with the above rule. However, if one is a strict prefix of the other, we have to choose if we eliminate the ith or the jth antecedent (and therefore rename X i to X j or vice-versa). Assume w.l.o.g. that H i is a strict prefix of H j .

1. If we eliminate the ith antecedent we risk to lose completeness due to the fact that we cannot prove that f ′ implies f (where f ′ is obtained from f by the above rule).

2. Vice-versa, eliminating the jth antecedent is not sound (f does not imply f ′ ), since a recipe which is valid after running history H i is not valid after running history H j if the trace blocks sometime between H i and H j .

We chose to solve this problem by adopting a "soft" semantics for the k predicate: k H (R, t) intuitively denotes that if a trace can successfully execute throughout history H, then R is a recipe for t. If H cannot be executed (due to the fact that the trace blocks), then there is no guarantee. This semantics of the k predicate makes the second option above sound. As a consequence of the use of the "soft" semantics of k, we introduce a new predicate r H (taking as arguments only the history), which denotes that the trace will successfully execute all commands in H. The initial knowledge base contains Horn clauses which state that r H holds whenever all the tests in H hold and the intruder can provide recipes for the inputs appearing in H. The fact that the tests in H hold is modeled by applying complete sets of unifiers as previously described and the fact that the intruder has to provide recipes for the inputs appearing in H is modeled by the antecedents of the Horn clauses.

Identities and Reachable Identities

The intruder identity predicate i is, as expected, also decorated with history arguments. By symmetry with the "knows" predicate, it enjoys the "soft" semantics: i H (R, R ′ ) intuitively denotes that if the trace can execute the commands in the history H, then R and R ′ will be recipes for the same term. In order to verify equivalence of two traces, we need however reachable identities.

We will therefore also use a predicate ri H (R, R ′ ) which intuitively states that H is executable and R and R ′ are recipes for the same term after execution of H:

ri H (R, R ′ ) is logically equivalent to r H ∧ i H (R, R ′ ).
After saturation takes place, the algorithm for checking trace equivalence will verify that all reachable identities in solved statements hold of the other trace and vice-versa.

We have briefly surveyed the difficulties associated with adapting our procedure to an active intruder. We have also informally presented the workarounds that we propose to circumvent these difficulties. We now proceed to fully formalize the intuitions given above, describe the main steps of our saturation procedure and prove that the new saturation procedure is sound and complete.

Modeling Traces as Horn Clauses

As we have already announced, the new saturation procedure will make use of four predicates.

Predicates and Semantics.

The intruder knowledge predicate k l1,...,l k (R, t) intuitively denotes that if the trace executed actions l 1 , . . . , l n , then R is a recipe for t in the resulting frame. The intruder identity predicate i l1,...,ln (R, R ′ ) intuitively denotes that if the trace executed actions l 1 , . . . , l n , then R and R ′ are recipes for the same term in the resulting frame.

The intruder reachability predicate r l1,...,ln denotes that the trace can indeed execute actions l 1 , . . . , l n . The intruder reachable identity predicate ri l1,...,ln (R, R ′ ) is intuitively a conjunction of the intruder identity predicate i l1,...,ln (R, R ′ ) and the intruder reachability predicate r l1,...,ln : ri l1,...,ln (R, R ′ ) intuitively states that the actions l 1 , . . . , l n can be executed by the trace and that after the execution R and R ′ are recipes for the same term in the resulting frame.

The predicates and their semantics are given in Figure 5.1. In formulas we also allow the usual logical connectives and existential and universal quantification of variables with the expected semantics. Formulas are interpreted over a symbolic trace T , a frame ϕ and a valuation σ.

When a formula f is ground we simply write (T, ϕ) |= f to denote that this formula holds for (T, ϕ). If moreover, Dom(ϕ) = ∅ we simply write T |= f for (T, ϕ) |= f . Predicates :

r l1,...,l k (Reachability predicate) k l1,...,l k (R, t) (intruder Knowledge predicate) i l1,...,l k (R, R ′ ) (Identity predicate) ri l1,...,l k (R, R ′ ) (reachable identity predicate) Semantics: (T, ϕ 0 ) |= r ℓ1,...,ℓi if (T, ϕ 0 ) L1 --→ (T 1 , ϕ 1 ) L2 --→ . . . Ln --→ (T n , ϕ n ) such that ℓ i = R L i ϕ i-1 for all 1 ≤ i ≤ n (T, ϕ 0 ) |= k ℓ1,...,ℓi (R, t) if when (T, ϕ 0 ) L1 --→ (T 1 , ϕ 1 ) L2 --→ . . . Ln --→ (T n , ϕ n ) such that ℓ i = R L i ϕ i-1 for all 1 ≤ i ≤ n then ϕ n ⊢ R t (T, ϕ 0 ) |= i ℓ1,...,ℓi (R, R ′ )
if there exists t s.t. (T, ϕ 0 , ) |= k ℓ1,...,ℓi (R, t) and (T, ϕ 0 , ) |= k ℓ1,...,ℓi (R ′ , t) (T, ϕ 0 ) |= ri ℓ1,...,ℓi (R, R ′ ) if (T, ϕ 0 , ) |= r ℓ1,...,ℓi and (T, ϕ 0 , ) |= i ℓ1,...,ℓi (R, R ′ ) Figure 5.1: Semantics of predicates (for ground terms R, R ′ , t) Example 5.5. Throughout this chapter, we will consider as a running example the following traces

T = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(dec(x, k), k)].send(c, ok) S 1 = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(a, k)].send(c, ok) S 2 = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(a ′ , k)].send(c, ok)
where a, a ′ , k ′ ∈ N are private names, where ok ∈ M is a public name and where c ∈ C is a public channel. We will also assume that we are using the classical Dolev-Yao term rewriting system R = {dec(enc(x, y), y) → x}. In the trace T , the test [x ? = enc(dec(x, k), k)] is a trick in order to test if x is an encryption with the key k. If x is of the form enc(t, k) for some term t, the test will succeed; otherwise it will fail.

We have that the formulas k send(c) (w 1 , enc(a, k)) and k send(c),send(c) (w 2 , enc(a ′ , k)) are true in all three traces (equipped with the empty frame). We also have that the formula i send(c),send(c),receive(enc(a,k)),test,send(c) (w 3 , ok) is true of all three traces (equipped with the empty frame): for T and S 1 the history is executable and the third output is the public name ok, while for the third trace the history is not executable and the i predicate holds for any recipes, including w 3 and ok. The formula r send(c),send(c),receive(enc(a,k)),test,send(c) is true of T and S 1 (equipped with the empty frame), but not of S 2 (equipped with the empty frame). The formula ri send(c),send(c),receive(enc(a,k)),test,send(c) (w 3 , ok) is true of T and S 1 (equipped with the empty frame), but not of S 2 (equipped with the empty frame). The formula k(w 1 , k) (with an empty sequence of history arguments) is true in the traces T, S 1 , S 2 equipped with the frame ϕ = {w 1 → k}.

Statements. We now define a class of Horn clauses that we call statements and which are extensively used throughout this chapter. Definition 5.7. A statement is a Horn clause of the form H ⇐ B 1 , . . . , B n where:

1. H ∈ {r l1,...,l k , k l1,...,l k (r, t), i l1,...,l k (r, r ′ ), ri l1,...,l k (r, r ′ )} and

2. B i = k l1,...,lj i (X i , t i ) (1 ≤ i ≤ n)
for some terms l 1 , . . . l k , t 1 , . . . , t n such that j i ≤ k (1 ≤ i ≤ n) and for some distinct variables X 1 , . . . , X n ∈ X . Moreover, if H = k l1,...,l k (R, t) for some term t, then Var (t) ⊆ Var (t 1 , . . . , t n ).

We implicitly assume that in a Horn clause all variables are universally quantified. Hence, all statements are closed formulas. The goal of the saturation procedure is to go from a set of initial statements to a set of solved statements which is equivalent to the initial set of statements. Definition 5.8. A statement is solved if for all 1 ≤ i ≤ n, B i = k l1,...,lj i (X i , x i ) for some variable x i ∈ X .

Working with a set of solved statements will make checking trace equivalence easier.

Example 5.6. For the trace T in our running example, we have that the following statements hold in T (equipped with the empty frame):

k send(c) (w 1 , enc(a, k)) ⇐ k send(c),send(c),receive(enc(x,k)),test,send(c) (w 3 , ok) ⇐ k send(c),send(c) (X, enc(x, k)) k send(c),send(c),receive(x),test,send(c) (ok, ok) ⇐ i send(c),send(c),receive(enc(x,k)),test,send(c) (w 3 , ok) ⇐ k send(c),send(c) (X, enc(x, k)) r send(c),send(c),receive(enc(a,k)),test,send(c) ⇐ k send(c),send(c),receive(z),test,send(c) (enc(X, Y ), enc(x, y)) ⇐ k send(c),send(c),receive(x),test,send(c) (X, x), k send(c),send(c),receive(x),test,send(c) (Y, y)

The Seed Statements

To each trace T , we will associate a set of statements Seed(T ) which we call the seed statements and which model the trace in a fully abstract manner. In this section. we explain how to compute the seed statements for any ground trace. Let T = a 1 .a 2 . . . . .a n be a ground trace. We assume w.l.o.g. the following naming conventions:

1. if a i is a receive action then

a i = receive(c i , x i ), 2. if a i is a send action then a i = send(c i , t i ), 3. if a i is a test actions then a i = [s i ? = t i ].
and that x i = x j for any i = j. Moreover, for each 1 ≤ i ≤ n we define ℓ i as follows:

ℓ i =    receive(c i , x i ) if a i = receive(c i , x i ) send(c i ) if a i = send(c i , t i ) test if a i = [s i ? = t i ]
and let the sets R(m), S(m) and T (m) denote the indices of the receive actions, send actions and respectively test actions of a 1 , . . . , a m :

   R(m) = {i | 1 ≤ i ≤ m, a i = receive(c i , x i )} S(m) = {i | 1 ≤ i ≤ m, a i = send(c i , t i )} T (m) = {i | 1 ≤ i ≤ m, a i = [s i ? = t i ]}
Given a trace T and a set of public names M 0 ⊆ M, the set of seed statements associated to T and M 0 , denoted Seed(T, M 0 ), is defined to be the set of statements given in Figure 5.2. If M 0 = M, the set Seed(T, M 0 ) = Seed(T, M) is said to be the set of seed statements associated to T and we write in this case Seed(T ) as a shortcut for Seed(T, M).

Note that in the set of seed statements we apply complete sets of unifiers modulo R for all tests. We use the notation mgu R ({s i = t i } 1≤i≤n ) for a complete set of unifiers which render s i equal to t i modulo R for all 1 ≤ i ≤ n. Moreover, we apply strongly complete sets of variants. We use the notation Variants(s 1 , . . . , s n ) for a strongly complete set of variants of tuple(s 1 , . . . , s n ), where tuple is a fresh free function symbol of arity n. The fact of applying complete sets of unifiers and strongly complete sets of variants allows us to get rid of the underlying term rewriting system and therefore work in the free algebra during the saturation process. r ℓ1στ ↓,...,ℓmστ ↓ ⇐ {k ℓ1στ ↓,...,ℓj-1στ ↓ (X j , x j στ ↓)} j∈R(m) for all 0 ≤ m ≤ n for all σ ∈ mgu R ({s k = t k } k∈T (m) ) for all τ ∈ Variants(ℓ 1 σ, . . . , ℓ m σ)

k ℓ1τ ↓,...,ℓmτ ↓ (w |S(m)| , t m τ ↓) ⇐ {k ℓ1τ ↓,...,ℓj-1τ ↓ (X j , x j τ ↓)} j∈R(m) for all m ∈ S(n) for all τ ∈ Variants(ℓ 1 , . . . , ℓ m , t m ) k(c, c) ⇐ for all public names c ∈ M 0 k ℓ1,...,ℓm (f (Y 1 , . . . , Y k ), f (y 1 , . . . , y k )τ ↓) ⇐ {k ℓ1,.
..,ℓm (Y j , y j τ ↓)} j∈{1,...,k} for all 0 ≤ m ≤ n for all function symbols f of arity k for all τ ∈ Variants(f (y 1 , . . . , y k )). Following the naming conventions above, we have that T = send(c 1 , t 1 ).send(c 2 , t 2 ).receive(c 3 , x 3 ). Using for example the equational unification algorithm described in Section 3.6, we find that mgu R ({x = enc(dec(x, k), k)}) = {{x → enc(y, k)}}, i.e. the only equational unifier of the two terms is the substitution σ = {x → enc(y, k)}. We have that the set of variants Variants(ℓ 1 σ, ℓ 2 σ, ℓ 3 σ, ℓ 4 σ, ℓ 5 σ) = Variants(ℓ 1 , ℓ 2 , receive(c, enc(y, k)), ℓ 4 , ℓ 5 ). The algorithm described in section 3.5 gives that the identity substitution τ = {} forms by itself a strongly complete set of variants of the tuple send(c), send(c), receive(c, enc(y, k)), test.

We have therefore that the statement

r send(c),send(c),receive(c,enc(y,k)),test,send(c) ⇐ k send(c),send(c) (X 3 , enc(y, k))
belongs to the set of seed statements of T (it is one of the statements of the first type in Figure 5.2).

Letting m = 5 ∈ S(n) and σ = {} ∈ Variants(ℓ 1 , . . . , ℓ 5 , t 5 ), we have that

k send(c),send(c),receive(c,x),test,send(c) (w 3 , ok) ⇐ k send(c),send(c) (X 3 , x)
is in the set of seed statements of T (it is one of the statement of the second type in Figure 5. Finally, we consider the function symbol dec and a strongly complete set of variants of the term dec(y 1 , y 2 ). We can use the algorithm in Section 3.5 to compute Variants(dec(y 1 , y 2 )) = {{}, {y 1 → enc(z, y 2 )}}. Therefore, the following two statements

k send(c) (dec(Y 1 , Y 2 ), dec(y 1 , y 2 )) ⇐ k send(c) (Y 1 , y 1 ), k send(c) (Y 2 , y 2 ) and k send(c) (dec(Y 1 , Y 2 ), z) ⇐ k send(c) (Y 1 , enc(z, y 2 )), k send(c) (Y 2 , y 2 )
are in the set of seed statements of T (fourth type of statement in Figure 5.2).

We will now show that the set of seed statements is a fully abstract encoding of the trace in the sense that is made precise by the following soundness and completeness lemmas.

Lemma 5.1 (Soundness of the set of seed statements). Let T be a ground trace. For any statement f in the set of seed statements Seed(T ) we have that T |= f . Proof. We assume the same naming conventions for T as in the beginning of the section. We prove that for each statement f ∈ Seed(T ) we have that

T |= f . 1. Let m ∈ {0, . . . , n}, let σ ∈ mgu R ({s k = t k } k∈T (m)
) and τ ∈ Variants(l 1 σ, . . . , l m σ) be substitutions as in the first type of statements in Figure 5.2. We show that

f = r ℓ1στ ↓,...,ℓmστ ↓ ⇐ {k ℓ1στ ↓,...,ℓj-1στ ↓ (X j , x j στ ↓)} j∈R(m) )
is a statement that is true in T . Let ω be an arbitrary substitution grounding for f . Assume furthermore that T |= (k ℓ1στ ↓,...,ℓj-1στ ↓ (X j , x j στ ↓))ω for all j ∈ R(m). We show that T |= (r ℓ1στ ↓,...,ℓmστ ↓ )ω by induction on m.

Base case: m = 0. We indeed have that T |= (r ℓ1στ ↓,...,ℓmστ ↓ )ω as m = 0 and therefore (r ℓ1στ ↓,...,ℓmστ ↓ )ω = r.

Inductive case: m > 0. We assume that T |= (r ℓ1στ ↓,...,ℓm-1στ ↓ )ω and we show that T |= (r ℓ1στ ↓,...,ℓmστ ↓ )ω by case analysis on a m . Let T 1 = T and ϕ 1 = ∅. As T |= (r ℓ1στ ↓,...,ℓm-1στ ↓ )ω, we have that there exist L 1 , . . . , L m-1 such that

(T i , ϕ i ) Li -→ (T i+1 , ϕ i+1 )
and L i ϕ i = R ℓ i στ ↓ω for all 1 ≤ i < m, where T i = (a i . . . . .a n ){x j → x j στ ↓ω} j∈R(i-1) and where ϕ i extends ϕ i-1 (for all 1 < i ≤ m). which is what we wanted to prove.

We have shown that T |= (r ℓ1στ ↓,...,ℓmστ ↓ )ω, which means that the statement f holds in T .

2. Let m ∈ S(n) and let σ ∈ Variants(l 1 , . . . , l n , t m ). We show that the statement

f = (k ℓ1σ↓,...,ℓmσ↓ (w |S(m)| , (t m σ)↓) ⇐ {k ℓ1σ↓,...,ℓj-1σ↓ (X j , x j σ↓)} j∈R(m) )
is true in T . Let ω be a substitution grounding for f . We assume that T |= (k ℓ1σ↓,...,ℓj-1σ↓ (X j , x j σ↓))ω for all j ∈ R(m) and we show that T |= (k ℓ1σ↓,...,ℓmσ↓ (w

|S(m)| , (t m σ)↓))ω. Let T i = (a i . . . . .a n ){x j → x j σω} j∈R(i-1) and ϕ i = ∪ 1≤j≤|S(i-1)| {w j → t o(j) σω}, where o(j) = min{x | |S(x)| = j}, i.e
. o(j) denotes the index of the jth send action. We distinguish two cases:

(a) if there exist L 1 , . . . , L m such that (T 1 , ϕ 1 ) We have shown that T |= f .

L1 --→ (T 2 , ϕ 2 ) L2 --→ . . . Lm --→ (T l+1 , ϕ l+1 ) such that L i ϕ i = R l i σ↓ω for all 1 ≤ i ≤ m, we have that ϕ m (w |S(m)| ) = t o(S(m)) σω = R t m σω,
3. Let c be a public name. We show that

f = k(c, c) ⇐
is true in T . Indeed, let ϕ = ∅. We have that ϕ ⊢ c c and therefore T |= k(c, c).

4. Let g be a function symbol of arity k, let m be an integer such that 0 ≤ m ≤ n and let σ ∈ Variants(g(x 1 , . . . , x k )). We show that the statement f = k ℓ1,...,ℓm (g(X 1 , . . . , X k ), g(x 1 , . . . , x k )σ↓) ⇐ {k ℓ1,...,ℓm (X j , x j σ↓)} j∈{1,...,k} is true in T . Let ω be an arbitrary substitution grounding for f . We assume that T |= k ℓ1,...,ℓm (X j , x j σ↓)ω for all 1 ≤ j ≤ k and we show that

T |= (k ℓ1,...,ℓm (g(X 1 , . . . , X k ), g(x 1 , . . . , x k )σ↓))ω.
Let (T 1 , ϕ 1 ) = (T, ∅). We distinguish between two cases:

(a) if (T 1 , ϕ 1 ) L1 --→ (T 2 , ϕ 2 ) L2 --→ . . . Lm --→ (T m+1 , ϕ m+1 ) such that L i ϕ i = R ℓ i for all 1 ≤ i ≤ m, we have that ϕ m+1 ⊢ Xj ω x j σ↓ω
for all 1 ≤ j ≤ k by our hypothesis. But this implies ϕ m+1 ⊢ g(X1ω,...,X k ω) g(x 1 σ↓ω, . . . , x k σ↓ω) = R g(x 1 , . . . , x k )σ↓ω which immediately implies that T |= (k ℓ1,...,ℓm (g(X 1 , . . . , X k ), g(x 1 , . . . , x k )σ↓))ω. (b) otherwise, we trivially have that T |= (k ℓ1,...,ℓm (g(X 1 , . . . , X k ), g(x 1 , . . . , x k )σ↓)ω.

We have shown that T |= f . We have shown for every statement f ∈ Seed(T ) that T |= f . In order to state completeness we first define the least Herbrand model of a set of statements. Definition 5.9. Let K be a set of statements. We define H(K) to be the smallest set of terms such that:

Simple Consequence f = H ⇐ B 1 , . . . , B n ∈ K σ grounding for f B 1 σ ∈ H(K) . . . B n σ ∈ H(K) Hσ ∈ H(K) ExtendK k u (R, t) ∈ H(K) k uv (R, t) ∈ H(K) ExtendI i u (R, R ′ ) ∈ H(K) i uv (R, R ′ ) ∈ H(K) Equivalently, H(K) is the least Herbrand model of K ∪ {k uv (X, x) ⇐ k u (X, x)} ∪ {i uv (X 1 , X 2 ) ⇐ i u (X 1 , X 2 )} n∈N .
By u and v we denote arbitrary sequences of terms. We will make use of this notation later on when it simplifies the presentation. Although the ExtendI rule is not needed for the completeness lemma below, it will be needed later when we state completeness of the saturation process. ------→ (S, ϕ) then:

1. r L1ϕ↓,...,Lnϕ↓ ∈ H(Seed(T )) 2. if ϕ ⊢ R t then k L1ϕ↓,...,Lnϕ↓ (R, t↓) ∈ H(Seed(T ))
Proof. We prove the two statements by induction on n. We assume that the two statements hold for any index less than n and we prove them for n. As (T, ∅) L1,...,Ln ------→ (S, ϕ), we have that:

1. there exists ω such that (L 1 ϕ↓, . . . , L n ϕ↓) = (ℓ 1 , . . . , ℓ n )ω and

2. s k ω = R t k ω for all k ∈ T (n). 1. As s k ω = R t k ω for all k ∈ T (n), it
follows by the definition of mgu R that there exists

σ ∈ mgu R ({s k ? = t k } k∈T (n) ) such that: (a) Dom(σ) ⊆ X, (b) s k σ = R t k σ for all k ∈ T (n) and (c) ω[X] = R (σπ)[X] for some substitution π where X = Var ({s k , t k } k∈T (n) ).
It follows that (ℓ 1 , . . . , ℓ n )ω↓ = (ℓ 1 , . . . , ℓ n )σπ↓ for some substitution π.

By the definition of Variants((ℓ 1 , . . . , ℓ n )σ), we have that there exists the substitution τ ∈ Variants((ℓ 1 , . . . , ℓ n )σ) such that (ℓ 1 , . . . , ℓ n )σπ↓ = (ℓ 1 , . . . , ℓ n )στ ↓τ ′ for some substitution τ ′ .

By the definition of the seed knowledge base Seed(T ), we have that the statement f = r ℓ1στ ↓,...,ℓnστ ↓ ⇐ k ℓ1στ ↓,...,ℓj-1στ ↓ (X j , x j στ ↓) j∈R(n) ∈ Seed(T ) is in the seed knowledge base Seed(T ).

Let {R j } j∈R(n) be terms such that L j = receive(c j , R j ) for all 1 ≤ j ≤ R(n). Let τ ′′ be a substitution equal to τ ′ except that it sends X j to R j for all j ∈ R(n). We have by the induction hypothesis that each component k ℓ1στ ↓,...,ℓj-1στ ↓ (X j , x j στ ↓)τ ′′ of the right hand side of f τ ′′ is in H(Seed(T )). Therefore the head r ℓ1στ ↓,...,ℓnστ ↓ τ ′′ of f τ ′′ is also in H(Seed(T )): Let τ ′′ = ω↓ ∪ τ ′ ∪ {Y j → R j } j∈{1,...,k} . Every antecendent k ℓ1,...,ℓn (Y j , y j τ ↓)τ ′′ (j ∈ {1, . . . , k}) in the body of gτ ′′ is in H(Seed(T )) by the induction hypothesis. Therefore, the head of gτ ′′ is also in H(Seed(T )):

r ℓ1στ ↓τ ′′ ,...,ℓnστ ↓τ ′′ = r ℓ1στ ↓τ ′ ,...,ℓnστ ↓τ ′ ∈ H(Seed(T )).
k ℓ1,...,ℓn (f (Y 1 , . . . , Y k ), f (y 1 τ ↓, . . . , y k τ ↓))τ ′′ ∈ H(Seed(T )),
which is equivalent, by the definition of τ ′′ , to what we had to prove:

k L1ϕ↓,...,Lnϕ↓ (f (R 1 , . . . , R k ), Rϕ↓) ∈ H(Seed(T )).
(c) If R = w j , let m be the smallest index such that S(m) = j and let t = t m be the term such that a m = send(c m , t m ). Let τ ∈ Variants(ℓ 1 , . . . , ℓ m , t) and τ ′ be substitutions such that (ℓ 1 , . . . , ℓ m , t)ω↓ = (ℓ 1 , . . . , ℓ m , t)τ ↓τ ′ . We have by the definition of the seed knowledge base that the statement

h = k ℓ1τ ↓,...,ℓmτ ↓ (w j , t m τ ↓) ⇐ {k ℓ1τ ↓,...,ℓ k-1 τ ↓ (X k , x k τ ↓)} k∈R(m) ∈ K(T ). Let R k be recipes of x k τ ↓τ ′ = R x k ω in the smallest possible prefix of ϕ. Let τ ′′ = τ ′ ∪{X k → R k } k∈R(m) . We have that every component k ℓ1τ ↓,...,ℓ k-1 τ ↓ (X k , x k τ ↓)τ ′′ (k ∈ R(m))
of the body of hτ ′′ is in H(Seed(T )) by the induction hypothesis. Therefore the head k ℓ1τ ↓,...,ℓmτ ↓ (w j , t m τ ↓)τ ′′ of hτ ′′ is also a simple consequence of the seed knowledge base. By the definition of τ ′′ , we obtain:

k L1ϕ↓,...,Lmϕ↓ (w j , t m ω↓) ∈ H(Seed(T )).
By rule ExtendK, we immediately obtain our conclusion.

As ϕ ⊢ R t implies by definition that t↓ = Rϕ↓, we have proven that k L1ϕ↓,...,Lnϕ↓ (R, t↓) ∈ H(K(T )).

We have shown that the two conclusions hold and therefore the seed knowledge base is complete.

In Lemma 5.1 and in Lemma 5.2 we prove soundness and respectively completeness of the set of seed statements. Therefore the set Seed(T ) is a fully abstract encoding of T into Horn clauses.

Procedure for Proving Trace Equivalence

We will now describe how to manipulate this set of statements in order to automatically check the equivalence of two processes. This is accomplished by the saturation procedure. The goal of the saturation procedure is to go from a sound and complete set of statements (the seed statements) to a sound and complete set of solved statements. Using the sound and complete set of solved statements, trace equivalence can then be checked algorithmically.

Knowledge Bases and Saturation

We now present the ingredients of the saturation procedure. During our saturation procedure, we will manipulate well-formed statements: Definition 5.10. A statement H ⇐ B 1 , . . . , B n is called well-formed if whenever it is solved and H = k t1,...,t k (R, t), we have that t ∈ X . A set of well-formed statements a knowledge base.

If K is a knowledge base we define K| solved = {f | f ∈ K, f is solved } to be the knowledge base restricted to the solved statements. If f = H ⇐ B 1 , . . . , B n is a statement and H = k u (R, t) for some u, R, t, we say that f is a deduction statement. If H = i u (R, R ′ ) for some u, R, R ′ , we say that f is an equational statement or an identity statement.

Canonical form. Given a solved deduction statement f , we define the canonical form of f to be the statement f ⇓ obtained by first applying Rule Rename as much as possible and then Rule Remove as much as possible:

Rename H ⇐ k u (X, x), k uv (Y, x), B 1 , . . . , B n (H ⇐ k u (X, x), B 1 , . . . , B n ){Y → X} Remove H ⇐ k u (X, x), B 1 , . . . , B n x ∈ Var (H) H ⇐ B 1 , . . . , B n
For any other type of statement f , the canonical form f ⇓ is defined to be equal to f . Note that the order in which the rules are applied is needed for soundness.

Example 5.8. Let the statement f be:

f = k send(c) (dec(enc(X, Y ), Z), x) ⇐ k send(c) (X, x), k send(c) (Y, y), k send(c) (Z, y) .
We have that the variable y appears twice in the body of f and we can therefore apply rule Rename. We obtain that

f ⇓ = k send(c) (dec(enc(X, Y ), Y ), x) ⇐ k send(c) (X, x), k send(c) (Y, y) .
Consequence. Given a knowledge base K, we define the set of consequences of K, denoted deriv(K), to be the smallest set such that:

Axiom k uv (R, t) ⇐ k u (R, t), B 1 , . . . , B m ∈ deriv(K) Res H ⇐ B 1 , . . . , B n ∈ K B 1 σ ⇐ C 1 , . . . , C m ∈ deriv(K) . . . B n σ ⇐ C 1 , . . . , C m ∈ deriv(K) Hσ ⇐ C 1 , . . . , C m ∈ deriv(K)
Note that if K is a finite knowledge base that only contains solved statements, given input t, ℓ 1 , . . . , ℓ k , i 1 , . . . i n , x 1 , . . . , x n , X 1 , . . . , X n , it is decidable whether

∃R.k ℓ1,...,ℓ k (R, t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K).
The definition of deriv(K) yields a direct recursive algorithm for the decision problem above which moreover computes R:

• (Axiom) Check whether t = x j for 1 ≤ j ≤ n. If this is the case return (yes, X j ).

• (Res) Otherwise, guess a (solved) statement k u (R ′ , t ′ ) ⇐ k u1 (Y 1 , y 1 ), . . . k u k (Y k , y k ) ∈ K and compute substitution σ such that k ℓ1,...,ℓ k (R ′ , t) = k u (R ′ , t ′ )σ. Check recursively whether ∃R i .k ui (R i , y i )σ ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K) for 1 ≤ i ≤ k. In that case return (yes, R ′ {Y i → R i } 1≤i≤n ). Otherwise return no.
Termination is ensured because the size of t when checking whether

∃R.k ℓ1,...,ℓ k (R, t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K)
strictly decreases in each recursive call. Indeed, when Update. Given a knowledge base K and a statement f , the update of K by f , denoted K ⊕ f , is defined to be K ∪ {f ⇓} if the head of f is not of the form k ℓ1,...,ℓ k (R, t). Otherwise, let

f = k u (R ′ , t ′ ) ⇐ k u1 (Y 1 , y 1 ), . . . k u k (Y k , y k ) ∈ K we have that t ′ ∈ X because f is well-formed (
f ⇓ = k ℓ1,...,ℓ k (R, t) ⇐ k ℓ1,...,ℓi 1 (X 1 , t 1 ), . . . , k ℓ1,...,ℓi n (X n , t n )
and

K ⊕ f =                (K ∪ {f ⇓}) if f is solved and for any R ′ f ′ [R ′ ] ∈ K ′ K ∪ {i ℓ1,...,ℓ k (R, R ′ ) ⇐ {k ℓ1,...,ℓi j (X j , t j )} j∈{1,...,n} } if f is solved and for some R ′ f ′ [R ′ ] ∈ K ′ K ∪ {f ⇓} if f is not solved where K ′ = deriv(K| solved ) and f ′ [R ′ ] = k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,
f = k send(c) (dec(enc(X, Y ), Y ), x) ⇐ k send(c) (X, x), k send(c) (Y, y) ,
we have that k send(c) (X, x) ⇐ k send(c) (X, x), k send(c) (Y, y) ∈ deriv(K). Therefore we are in the second case of the update operator and we will add an identity statement

i send(c) (dec(enc(X, Y ), Y ), X) ⇐ k send(c) (X, x), k send (Y, y)
to the knowledge base instead of the deduction statement f .

Note that even if the statement f by which a knowledge base K is updated is not well-formed, the resulting set of statements K ⊕ f is still a knowledge base, since the case where f is not well-formed is captured by the second case in the definition of K ⊕ f and an equational statement is added instead of the not well-formed statement.

Initial knowledge base.

The initial knowledge base associated to a set of seed statements Seed(T, M 0 ), denoted K i (Seed(T, M 0 )), is defined to be the empty knowledge base updated by the set of seed statements:

K i (Seed(T, M 0 )) = ∅ ⊕ f ∈Seed(T,M0) f.
When M 0 = M, we use K i (T ) as a shortcut of K i (Seed(T, M)) and we say that K i (T ) is the initial knowledge base associated to T .

Saturation. Given a knowledge base K, the saturated knowledge base sat(K) is obtained from K by applying the inference rules given in Figure 5.3, until reaching a fixed point (i.e. sat(K) is such that K ⇒ * sat(K) and if sat(K) Before stating completeness, we have to extend the least Herbrand model associated to a set of statement by interpreting the predicate i w as a monotonic (in w) congruence relation. Definition 5.11. Let K be a set of statements. We define H e (K) to be the smallest set of terms such that H(K) ⊆ H e (K) and such that:

⇒ * K ′ , then K ′ ⊆ sat(K)). Resolution f ∈ K, g ∈ K| solved , f = H ⇐ k uv (X, t), B 1 , . . . , B n g = k w (R, t ′ ) ⇐ B n+1 , . . . , B m σ = mgu(k w (R, t ′ ), k u (X, t)) t ∈ X K ⇒ K ⊕ h where h = (H ⇐ B 1 , . . . , B m )σ Equation f, g ∈ K| solved , f = k u (R, t) ⇐ B 1 , . . . , B n g = k u ′ v ′ (R ′ , t ′ ) ⇐ B n+1 , . . . , B m σ = mgu(k u ( , t), k u ′ ( , t ′ )) K ⇒ K ⊕ h where h = (i u ′ v ′ (R, R ′ ) ⇐ B 1 , . . . , B m )σ Test f, g ∈ K| solved , f = i u (R, R ′ ) ⇐ B 1 , . . . , B n g = r u ′ v ′ ⇐ B n+1 , . . . , B m σ = mgu(u, u ′ ) K ⇒ K ⊕ h where h = (ri u ′ v ′ (R, R ′ ) ⇐ B 1 , . . . , B m )σ
Refl i w (R, R) ∈ H e (K) Sym i w (R 1 , R 2 ) ∈ H e (K) i w (R 2 , R 1 ) ∈ H e (K) Extend i u (R, R ′ ) ∈ H e (K) i uv (R, R ′ ) ∈ H e (K) Tran i w (R 1 , R 2 ) ∈ H e (K) i w (R 1 , R 3 ) ∈ H e (K) i w (R 1 , R 3 ) ∈ H e (K) Cong i w (R 1 , R ′ 1 ) ∈ H e (K), • • • , i w (R n , R ′ n ) ∈ H e (K) f ∈ F, ar(f ) = n i w (f (R 1 , . . . R n ), f (R ′ 1 , . . . R ′ n )) ∈ H e (K) Equational Consequence k w (R, t) ∈ H(K) i w (R, R ′ ) ∈ H e (K) k w (R ′ , t) ∈ H e (K)
We are now ready to state the completeness theorem. ------→ (S, ϕ).

Let K be a saturated knowledge base associated to T , i.e., K = sat(K i (T )). Then we have that 1. r L1ϕ↓,...,Lnϕ↓ ∈ H e (K| solved ), 2. if ϕ ⊢ R t then k L1ϕ↓,...,Lnϕ↓ (R, t↓) ∈ H e (K| solved ) and 3. if ϕ ⊢ R t and ϕ ⊢ R ′ t, then i L1ϕ↓,...,Lnϕ↓ (R, R ′ ) ∈ H e (K| solved ).

Effectiveness of the Saturation

In the set of seed statements, there are an infinite number of statements due to the statements of the form k(m, m) ⇐ for names m ∈ M. We will show that all but a finite number of them do not interfere in the saturation process and that it is therefore sufficient to consider a finite set of seed statements for saturation:

Lemma 5.3. Let T be a trace, let M T = {m ∈ M | m ∈ N ames(T )} be the set of public names occurring in T and let M T = M \ M T be the set of public names not occuring in T . Let

K M T = {{k(m, m) ⇐} m∈M T ∪ {i(m, m) ⇐} m∈M T ∪ {ri(m, m) ⇐} m∈M T }. Then sat(K i (T )) = sat(K i (Seed(T, M T ))) ⊎ K M T .
To prove this lemma, we first need two other helper lemmas. Let M 0 ⊆ M be public names and let

K names = {{k(m, m) ⇐} m∈M0 ∪ {i(m, m) ⇐} m∈M0 ∪ {ri(m, m) ⇐} m∈M0 }
be a set of statements involving names in M 0 . Recall that ⇒ denotes the saturation relation; we will denote by ⇒ = its reflexive closure.

Lemma 5.4. Let K be a knowledge base such that N ames(K)

∩ M 0 = ∅. Let K 1 ⊆ K names . If h is a statement such that N ames(h) ∩ M 0 = ∅, then (K ⊎ K 1 ) ⊕ h = (K ⊕ h) ⊎ K 1 .
Proof. If h is not solved or if it is not a deduction statement, we have that

(K ⊎ K 1 ) ⊕ h = (K ⊎ K 1 ) ∪ {h} = (K ∪ {h}) ⊎ K 1 = (K ⊕ h) ⊎ K 1 . If h is a solved deduction statement, let h⇓ = k ℓ1,...,ℓ k (R, t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ).
We distinguish two cases:

1. either k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv((K ⊎ K 1 )| solved ) for any R ′ , in which case (K ⊎ K 1 ) ⊕ h = (K ⊎ K 1 ) ∪ {h⇓} = (K ∪ {h⇓}) ⊎ K 1 .
It follows that k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K| solved ) for any R ′ either (since K ⊆ K ⊎ K 1 ). Therefore K ⊕ h = K ∪ {h⇓} and we immediately conclude by replacing K ∪ {h⇓} by K ⊕ h in the equation above.

or k

ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv((K ⊎ K 1 )| solved ) for some R ′ . In this case, (K ⊎ K 1 ) ⊕ h = (K ⊎ K 1 ) ∪ {f } where f = i ℓ1,...,ℓ k (R, R ′ ) ⇐ {k ℓ1,...,ℓi j (X j , x j )} j∈{1,...,n} }.
To conclude we show the following claim.

If N ames(t) ∩ M 0 = ∅ and

k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv((K ⊎ K 1 )| solved ) then k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K| solved )
To proof this claim we proceed by induction on the size of the proof tree of

k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv((K ⊎ K 1 )| solved ).
(c) otherwise f, g ∈ K. Therefore N ames(h) ∩ M 0 = ∅. We choose K ′ = K ⊕ h and K 2 = K 1 to conclude.

if rule

Test triggered, we distinguish two cases:

(a) if i(m, m) ⇐ ∈ K 1 plays the role of f , we choose K ′ = K and K 2 = K 1 ∪ {ri(m, m)} to conclude.
(b) otherwise f ∈ K. The statement g must also be in K since g is a reachability statement and K 1 does not contain reachability statements. We choose

K ′ = K ⊕ h and K 2 = K 1 to conclude.
We are now ready to prove Lemma 5.3.

K M T = {{k(m, m) ⇐} m∈M T ∪ {i(m, m) ⇐} m∈M T ∪ {ri(m, m) ⇐} m∈M T }. Then sat(K i (T )) = sat(K i (Seed(T, M T ))) ⊎ K M T .
Proof. By Lemma 5.4, we have that

K i (T ) = K i (Seed(T, M T )) ⊎ {k(m, m) ⇐} m∈M T .
Letting M 0 = M T and iterating Lemma 5.5, we obtain that if

K i (Seed(T, M T )) ⊎ {k(m, m) ⇐} m∈M0 ⇒ * K ′′ , then K ′′ = K ′ ⊎ K 2 with K i (Seed(T, M T )) ⇒ * K ′ , N ames(K ′ ) ∩ M 0 = ∅ and K 2 ⊆ K T .
If K ′′ is saturated, K ′ and K 2 must be saturated as well. Therefore in the case K ′′ is saturated, we have

K 2 = K M T and K ′ = sat(K i (Seed(T, M T ))). We obtained therefore that sat(K i (T )) = sat(K i (Seed(T, M T ))) ⊎ K M T ,
which is what we wanted to show. Therefore, to obtain the saturated knowledge base of the initial knowledge base K i (T ) of T , it is sufficient to saturate starting from the initial knowledge K i (Seed(T, M T )) of Seed(T, M T ) (which is finite) and add the statements in K M T at the end.

Checking for Equivalence

We have shown how to saturate an initial knowledge base associated to a trace in a sound and complete manner. We will now show how to use the saturated knowledge base associated to a trace in order to prove trace inclusion for determinate processes. Trace equivalence can be obtained by verifying that trace inclusion holds in both directions. The procedure for checking trace inclusion for determinate processes directly follows from Theorem 5.4.

Theorem 5.4. Let T be a trace and let P be a determinate process. Let K be the set of solved statements from a saturated knowledge base associated to T . Then T ⊑ c P iff the following tests hold: Reachability r l1,...,ln ⇐ {k wi (X i , x i )} i∈{1,...,m} ∈ K c 1 , . . . , c k fresh constants σ :

Var (l 1 , . . . , l n ) → {c 1 , . . . , c k } is a bijection k l1σ,...,li-1σ (R i , t i σ) ∈ H(K) for all i such that l i = receive(d i , t i ) M i = l i if l i ∈ {test, send( )} M i = receive(d i , R i ) if l i = receive(d i , t i ) (P, ∅) M1,...,Mn ======⇒ (T ′ , ϕ) Identity ri l1,...,ln (R, R ′ ) ⇐ {k wi (X i , x i )} i∈{1,...,m} ∈ K c 1 , . . . , c k fresh constants σ : Var (l 1 , . . . , l n ) → {c 1 , . . . , c k } is a bijection k l1σ,...,li-1σ (R i , t i σ) ∈ H(K) for all i such that l i = receive(t i ) M i = l i if l i ∈ {test, send( )} M i = receive(d i , R i ) if l i = receive(d i , t i ) (P, ∅) M1,...,Mn ======⇒ (T ′ , ϕ) such that (Rω = R ′ ω)ϕ where ω = {X i → x i σ}
Note that the infinity of statements K M T which are guaranteed by Lemma 5.3 to be in the saturated knowledge base K do not need to be checked since they will trivially pass. It is therefore sufficient to check the (hopefully finite number of) statements from sat(Seed(T, M T )).

The full proof of the above theorem is in Section 5.8. Theorem 5.4 directly implies that the following algorithm for checking if T ⊆ P for a trace T and a determinate process P is correct:

1. let K = sat(K i (T ))| solved \ K M T
denote the interesting solved statements in the saturated knowledge base associated to T (the statements in K M T trivially pass all tests and therefore do not have to be checked); by Lemma 5.3, we have that K = sat(K i (Seed(T, M T )))| solved .

2. for every reachability statement r l1,...,ln ⇐ {k wi (X i , x i )} 1≤i≤m in K:

(a) choose fresh constants c 1 , . . . , c k , one for each variable in Var (l 1 , . . . , l k ) and a bijection σ between {c 1 , . . . , c k } and Var (l 1 , . . . , l k ) (b) for every i such that l i = receive(d i , t i ), find an R i such that k l1σ,...,li-1σ (R i , t i ) ∈ H(K) (the existence of R i is guaranteed by the soundness and completeness of the saturation procedure). Furthermore, a simple recursive algorithm that finds R i follows from the definition of H(K).

(c) let M i = l i if l i ∈ {test, send(d i )} and M i = receive(d i , R i ) if l i = receive(d i , t i ) (d) test if (P, ∅) M1,...,Mn
======⇒ (T ′ , ϕ) for some T ′ and some ϕ. If the above transition does not take place, return 'no'; otherwise continue.

3. for every reachable identity statement ri l1,...,ln (R, R ′ ) ⇐ {k wi (X i , x i )} i∈{1,...,m} in K:

(a) choose fresh constants c 1 , . . . , c k , one for each variable in Var (l 1 , . . . , l k ) and a bijection σ between {c 1 , . . . , c k } and Var (l 1 , . . . , l k ) (b) for every i such that l i = receive(d i , t i ), find an R i such that k l1σ,...,li-1σ (R i , t i ) ∈ H(K) (the existence of R i is guaranteed by the soundness and completeness of the saturation procedure)

(c) let M i = l i if l i ∈ {test, send(d i )} and M i = receive(d i , R i ) if l i = receive(d i , t i ) (d) test if (P, ∅)
M1,...,Mn ======⇒ (T ′ , ϕ) for some T ′ and some ϕ. If the above transition does not take place, return 'no'; otherwise continue. We have that the process {S 1 , S 2 } is determinate. It is true that T is trace included in {S 1 , S 2 } and that {S 1 , S 2 } is trace-included in T . This means that T is trace equivalent to {S 1 , S 2 }. While we cannot reproduce here all the tests performed by the algorithm that we described above, we can show that some interesting reachability statements found in the saturated knowledge base of T perform successfully in {S 1 , S 2 }. Indeed, the saturated knowledge base of T contains the statements = =========================== ⇒ (T ′ , ϕ) for some trace T ′ and some frame ϕ. This is indeed the case, since the above run is a valid run of the first trace S 1 ⊆ {S 1 , S 2 } of the process {S 1 , S 2 }.

f 1 = r send(c),send (
Similarly, we have k send(c),send(c) (w 2 , enc(a ′ , k)) ∈ H(K) and therefore we have to check, by the first type of test performed by the algorithm, if

({S 1 , S 2 }, ∅) send(c),send(c),receive(c,w2),test,send(c) = =========================== ⇒ (T ′ , ϕ)
for some trace T ′′ and some frame ϕ ′ . This is indeed the case, since the above run is a valid run of the second trace S 2 ⊆ {S 1 , S 2 } of the process {S 1 , S 2 }.

Soundness of Saturation

This section is dedicated to proving the lemmas needed to prove Theorem 5.2, i.e. the soundness of the saturation procedure. We first need a small helper lemma.

Lemma 5.6 (Monotonicity of the knowledge predicate

). If T |= k u (R, t) then T |= k uv (R, t).
Proof. Immediate because of the 'soft' semantics of k.

We now show that the canonicalization rules are sound. Proof. We will show that each canonicalization rule is sound:

1. For the Rename rule, consider a statement

f = H ⇐ k t1,...,t k (X, x), k t1,...,t l (Y, x), B 1 , . . . , B n
where k ≤ l and we show that if T |= f then T |= g where

g = (H ⇐ k t1,...,t k (X, x), B 1 , . . . , B n ){Y → X} Let τ be a grounding substitution for g such that T |= k t1,...,t k (X, x){Y → X}τ , B 1 {Y → X}τ, . . . , B n {Y → X}τ . We show that if T |= f then T |= H{Y → X}τ .
Let τ ′ be a substitution identical to τ , except for τ ′ (Y ) = τ (X). We will show that all the antecedents in f τ ′ are true in T . Indeed, k t1,...,t k (X, x)τ ′ = k t1,...,t k (X, x){Y → X}τ holds by hypothesis. As k ≤ l and T |= k t1,...,t k (X, x)τ ′ , we have by Lemma 5.6 that T |= k t1,...,t l (X, x)τ ′ and by the choice of τ ′ , we have k t1,...,t l (X, x)τ ′ = k t1,...,t l (Y, x)τ ′ . Furthermore T |= B 1 τ ′ = B 1 {Y → X}τ, . . . , B n τ ′ = B n {Y → X}τ by hypothesis. As T |= f , and all antecedents of f τ ′ are true in T , we obtain that T |= Hτ ′ .

But Hτ ′ = H{Y → X}τ and therefore we have that T |= H{Y → X}τ . As we have chosen τ arbitrarily, it follows that T |= g.

2.

For the Remove rule, consider a solved statement

f = H ⇐ k t1,...,t k (X, x), B 1 , . . . , B n
such that the rule Rename does not apply to f and such that x ∈ Var (H). We show that if T |= f then T |= g where

g = H ⇐ B 1 , . . . , B n
Let τ be an arbitrary substitution such that T |= B 1 τ, . . . , B n τ . We will show that T |= Hτ and hence T |= g.

Let (T 1 , ϕ 1 ) = (T, ∅). We distinguish between two cases:

(a) if (T 1 , ϕ 1 ) L1 --→ (T 2 , ϕ 2 ) L2 --→ . . . L k --→ (T k+1 , ϕ k+1 ) such that L i ϕ i = t i τ for all 1 ≤ i ≤ k,
we consider the substitution τ ′ to be identical to τ except for τ ′ (x) = (Xτ )ϕ k+1 . As x ∈ Var (H) and because f is solved and the rule Rename does not apply, we have that x ∈ Var (B 1 , . . . , B n ) and therefore T |= B 1 τ ′ = B 1 τ, . . . , B n τ ′ = B n τ . Furthermore, we have that T |= k t1,...,t k (X, x)τ ′ by the definition of k. As all antecedents of f τ ′ are true in T and T |= f , it follows that T |= Hτ ′ . But Hτ = Hτ ′ since x ∈ Var (H) and therefore T |= Hτ .

(b) otherwise, we trivially have that T |= k t1,...,t k (X, x)τ . We have that all antecedents of f τ are true in T and therefore, as T |= f , it follows that T |= Hτ .

We have shown that T |= g, therefore the rule Remove is sound.

We have shown that both rules for computing the canonical form are sound and therefore T |= f ⇓ whenever T |= f . Next we show that the consequence rules are sound.

As T |= B 1 στ, . . . , B n στ and because T |= f we have that T |= k u (R, t)στ . By monotonicity of k (Lemma 5.6) we also have that

T |= k u ′ v ′ (R, t)στ .
As T |= B 1 στ . . . , B n στ and because T |= g we also obtain that

T |= k u ′ v ′ (R ′ , t ′ )στ .
But this is exactly the definition of

T |= i u ′ v ′ (R, R ′ )στ .
We have shown that the head of hτ is true in T . As τ was chosen arbitrarily, it follows that h holds in T . Proof. We consider the following statements:

f = i u (R, R ′ ) ⇐ B 1 , . . . , B n g = r u ′ v ′ ⇐ B n+1 , . . . , B m h = (ri u ′ v ′ (R, R ′ ) ⇐ B 1 , . . . , B m )σ
where σ = mgu(u, u ′ ).

Let τ be an arbitrary substitution grounding for h. We assume that T |= B 1 στ, . . . , B m στ and we show that T |= ri u (R, R ′ )τ . Indeed, as T |= B 1 στ, . . . , B n στ and as T |= f , we have that

T |= i u (R, R ′ )στ.
(5.1)

As T |= B n+1 στ, . . . , B m στ and as T |= g, we have that

T |= r u ′ v ′ στ. (5.2)
But σ = mgu(u, u ′ ) and therefore uστ = u ′ στ . Therefore, by Equations (5.1) and (5.2), we immediately obtain T |= ri u ′ v ′ (R, R ′ )στ , which is what we wanted. As τ was chosen arbitrarily, it follows that T |= h.

We have shown soundness of all saturation rules. Now we prove soundness of the ⊕ operator.

Lemma 5.12 (Soundness of the update). If for all f ∈ K we have that T |= f and if T |= g, then for any f ∈ (K ⊕ g) we have that T |= f . Proof. If K ⊕ g = K ∪ {g⇓}, we immediately conclude by Lemma 5.8. Otherwise, it must be that

g⇓ = k ℓ1,...,ℓ k (R, t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n )
for some R, t, ℓ 1 , . . . , ℓ k , i 1 , . . . , i n , X 1 , . . . , X n , x 1 , . . . , x n and K ⊕ g = K ∪ {h}, where

h = i ℓ1,...,ℓ k (R, R ′ ) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n )
and where

g ′ = k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K| solved ).
It is sufficient to show that T |= h. As K| solved ⊆ K, it immediately follows that g ′ ∈ deriv(K) and, by Lemma 5.8, T |= g ′ .

We now show that T |= h. Let τ be an arbitrary substitution grounding for h such that the antecedents of hτ are true in T . As the antecedents of hτ are the same as the antecedents of g⇓τ and those of g ′ τ , and as T |= g and T |= g ′ we have that T |= k ℓ1,...,ℓ k (R, t)τ and T |= k ℓ1,...,ℓ k (R ′ , t)τ .

But this immediately implies that T |= i ℓ1,...,ℓ k (R, R ′ )τ (the head of hτ ). As τ was chosen arbitrarily, it follows that T |= h.

We are now ready to prove Theorem 5.2.

Theorem 5.2 (soundness of saturation). If f ∈ sat(K i (T )) then T |= f .
Proof. Immediate by Lemma 5.1 to Lemma 5.12.

Completeness of Saturation

This section is dedicated to proving the lemmas needed to prove Theorem 5.3, i.e. the completeness of the saturation procedure. We first show completeness for statements which are consequences of the knowledge base. Proposition 5.2. Let K be a knowledge base, let f = H ′ ⇐ C 1 , . . . , C m be a statement such that f ∈ deriv(K) and let τ be a substitution grounding for f such that

C i τ ∈ H(K) for all 1 ≤ i ≤ n. Then H ′ τ ∈ H(K).
Proof. Induction on the proof tree of f ∈ deriv(K).

If the Axiom rule was used, then we have Hσ ∈ H(K) by the ExtendK rule.

If the Res rule was used, we have that there exists H ⇐ B 1 , . . . , B n ∈ K and a substitution

σ such that H ′ = Hσ and B i σ ⇐ C 1 , . . . , C m ∈ deriv(K) (1 ≤ i ≤ n).
By the induction hypothesis, we have that

B i στ ∈ H(K). As H ⇐ B 1 , . . . , B n ∈ K, it follows that Hστ = H ′ τ ∈ H(K),
which is what we had to show.

We need a technical definition that will be useful in inductive proofs.

Definition 5.12. Let S(H, K) be the size of the smallest proof tree of H ∈ H(K) (defined only when H ∈ H(K)).

Before proceeding, we show the following technical result.

Proposition 5.3. Let K be a knowledge base. If k w (R, t) ∈ H e (K) and i w (R, R ′ ) ∈ H e (K), then k w (R ′ , t) ∈ H e (K).
Proof. As k w (R, t) ∈ H e (K), it follows that there exist R ′′ such that

k w (R ′′ , t) ∈ H(K) (5.3)
and such that i w (R, R ′′ ) ∈ H e (K). But i w (R, R ′ ) ∈ H e (K) and therefore, by the symmetry and transitivity of i w ( , ), we have that

i w (R ′′ , R ′ ) ∈ H e (K). (5.4)
Using Equations 5.3 and 5.4 we immediately obtain by the definition of H e that k w (R ′ , T ) ∈ H e (K).

The following definition and helper lemma help characterize the facts in H(K). Definition 5.13. We write w ⊑ w ′ whenever w is a prefix of w ′ : i.e. there exists ℓ 1 , . . . , ℓ n such that w ′ = ℓ 1 , . . . , ℓ n and w = ℓ 1 , . . . , ℓ m for some 0 ≤ m ≤ n.

Proposition 5.4. If k w (R, t) ∈ H(K) (resp. i w (R, S) ∈ H(K)) then there exist a statement f = k w ′ (R ′ , t ′ ) ⇐ B 1 , . . . , B m ∈ K (resp. f = i w ′ (R ′ , S ′ ) ⇐ B 1 , . . . , B m ∈ K) and a substitution σ such that R ′ σ = R, t ′ σ = t (resp. S ′ σ = S), w ′ σ ⊑ w, B i σ ∈ H(K) for all 1 ≤ i ≤ m and 1≤i≤m S(B i σ, K) < S(k w (R, t), K) (resp. 1≤i≤m S(B i σ, K) < S(i w (R, S), K)).
Proof. We prove the proposition by induction on the smallest proof tree of H = k w (R, t) ∈ H(K) (resp. H = i w (R, S) ∈ H(K)). We proceed by case distinction on the last proof rule that has been applied.

• Simple Consequence: In this case we have that there exist a statement f = H ′ ⇐ B 1 , . . . , B m ∈ K and a substitution σ such that

H ′ σ = H, B i σ ∈ H(K) for all 1 ≤ i ≤ m and 1≤i≤m S(B i σ, K) + 1 = S(k w ′ (R ′ , t ′ )σ, K).
Hence we directly conclude.

• ExtendK: In this case H = k w (R, t) and we have that w = uv for some u, v and k u (R, t) ∈ H(K). By induction hypothesis, we have that there exists

f = k u ′ (R ′ , t ′ ) ⇐ B 1 , . . . , B m ∈ K and σ such that R ′ σ = R, t ′ σ = t, u ′ σ ⊑ u, B i σ ∈ H(K) for all 1 ≤ i ≤ m and 1≤i≤m S(B i σ, K) < S(k w (R, t), K). As u ⊑ w, we also have that u ′ σ ⊑ w. Moreover, S(k w (R, t), H(K)) = S(k u (R, t), H(K)) + 1 > 1≤i≤m S(B i σ, K) which allows us to con- clude.
• ExtendI: In this case H = i w (R, S) and we have that w = uv for some u, v and i u (R, S) ∈ H(K). By induction hypothesis, we have that there exists

f = i u ′ (R ′ , S ′ ) ⇐ B 1 , . . . , B m ∈ K and σ such that R ′ σ = R, S ′ σ = S, u ′ σ ⊑ u, B i σ ∈ H(K) for all 1 ≤ i ≤ m and 1≤i≤m S(B i σ, K) < S(k w (R, t), K). As u ⊑ w, we also have that u ′ σ ⊑ w. Moreover, S(i w (R, S), H(K)) = S(i u (R, S), H(K)) + 1 > 1≤i≤m S(B i σ, K) which allows us to con- clude.
We are now ready to show completeness with respect to equational statements. Lemma 5.13. Let K be a saturated knowledge base, let f ∈ K be a statement

f = i w (R, R ′ ) ⇐ B 1 , . . . , B n
and let σ be a substitution grounding for f such that B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n. Then we have that

(i w (R, R ′ ))σ ∈ H(K| solved ).
Proof. Let G = i∈{1,...,n} S(B i σ, K| solved ). We prove the lemma by induction on G. If f is a solved statement, the conclusion is immediate by the definition of H. Otherwise, if f is not a solved statement, there exists some B j (1 ≤ j ≤ n) such that B j = k wj (X j , t j ) and t j ∈ X .

As B j σ ∈ H(K| solved ), it follows by Proposition 5.4 that w j = u j v j for some u j , v j and that there exists

g = k u ′ j (R ′ j , t ′ j ) ⇐ B n+1 , . . . , B m ∈ K| solved
and a substitution σ ′ grounding for g such that

B n+1 σ ′ , . . . , B m σ ′ ∈ H(K| solved ), R ′ j σ ′ = X j σ, t ′ j σ ′ = t j σ, u ′ j σ ′ = u j σ and S(B j σ) = 1 + i∈{n+1,...,m} S(B i σ ′ ). As ω = σ ∪ σ ′ is a unifier of H = k u ′ j (R ′ j , t ′ j )
and k uj (X j , t j ), it follows that the two terms are unifiable. Let τ = mgu(H, k uj (X j , t j )) denote their most general unifier. As K is saturated, it follows that the Resolution saturation rule was applied to f and g and therefore the resulting equational statement

h = i w (R, R ′ ) ⇐ B 1 , . . . , B j-1 , B j+1 , . . . , B m τ ∈ K
must be in K (by the update function, equational statements are added to the knowledge base).

As ω is a unifier of H and k uj (X j , t j ) and as τ = mgu(H, k uj (X j , t j )), it follows that there exists ω ′ such that ω = τ ω ′ . We have that ω ′ is a substitution grounding for h, that

B i τ ω ′ ∈ H(K| solved )
for i ∈ {1, . . . , j -1, j + 1, . . . , m} and that i∈{1,...,j-1,j+1,...,m} S(B i τ ω ′ , K| solved ) ≤ G -1.

Therefore we can apply the induction hypothesis to h and ω ′ and conclude.

We now prove completeness with respect to the intruder reachable identity predicate.

Lemma 5.14. Let K be a saturated knowledge base, let f ∈ K be a statement

f = ri w (R, R ′ ) ⇐ B 1 , . . . , B n
and let σ be a substitution grounding for f such that B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n. Then we have that

(ri w (R, R ′ ))σ ∈ H(K| solved ).
Proof. Identical to Lemma 5.13.

Lemma 5.15. Let K be a saturated knowledge base, let f ∈ K be a statement

f = r w ⇐ B 1 , . . . , B n
and let σ be a substitution grounding for f such that B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n.

Then we have that r w σ ∈ H(K| solved ).

Proof. Identical to Lemma 5.13 and Lemma 5.14.

We now show completeness of the intruder reachable identity predicate.

Lemma 5.16. Let K be a saturated knowledge base. If

r u ∈ H(K| solved ) and i u (R, R ′ ) ∈ H(K| solved ), then ri u (R, R ′ ) ∈ H(K| solved ).
Proof. As r u ∈ H(K| solved ), there exists a solved statement f = r v ⇐ B 1 , . . . , B n ∈ K| solved and a substitution σ grounding for f such that B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n and such that u = vσ.

As i u (R, R ′ ) ∈ H(K| solved ), there exists by Proposition 5.4 a solved statement g = i w (T, T ′ ) ⇐ B n+1 , . . . , B m and a substitution τ grounding for g such that B i τ ∈ H(K| solved ) for all n + 1 ≤ i ≤ m and such that u ⊒ wτ , R = T τ and R ′ = T ′ τ . As vσ = u ⊒ wτ , it follows that v = v 0 v 1 such that v 0 and w are unifiable (σ ∪ τ is such a unifier). Let ω = mgu(v 0 , w) and let π be such that σ ∪ τ = ω • π.

As the knowledge base is saturated, the Test saturation rule must have fired for f and g and therefore K must have been updated by h where

h = (ri v (T, T ′ ) ⇐ B 1 , . . . , B m )ω .
But as h is not a deduction fact, the update must have simply added h to K and therefore h ∈ K.

We have that B i ωπ = B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n and that B i ωπ = B i τ ∈ H(K| solved ) for all n + 1 ≤ i ≤ m. By applying Lemma 5.14 to the statement h and the substitution π, we obtain that ri v (T, T ′ )ωπ = ri u (R, R ′ ) ∈ H(K| solved ).

1. If the Rename canonicalization rule can be applied, then f must be of the form:

f = k w (R, t) ⇐ k u (X, x), k uv (Y, x), B 3 , . . . , B n .
Let us consider the statement f ′ obtained by applying Rename to f :

f ′ = k w (R, t) ⇐ k u (X, x), B 3 , . . . B n {Y → X}.
By the definition of a statement, Y has at most one occurence in B 1 , . . . , B n and therefore we have that (B

1 , B 3 , . . . B n ){Y → X} = (B 1 , B 3 , . . . , B n ). Therefore (B 1 , B 3 , . . . B n ){Y → X}σ = (B 1 , B 3 , . . . , B n )σ.
We can therefore apply the induction hypothesis on f ′ and σ to obtain that k w (R, t){Y → X}σ ∈ H e (K| solved ).

(5.5)

But k u (X, x)σ ∈ H(K| solved ) and k uv (Y, x)σ ∈ H(K| solved ). By Lemma 5.17, we have that

i uv (X, Y )σ ∈ H(K| solved ). (5.6)
From Equation 5.5 and Equation 5.6 and as uv is a prefix of w by the definition of a statement, we conclude by Proposition 5.3 that

k w (R, t)σ ∈ H e (K| solved ).
2. If the Remove canonicalization rule can be applied, then f must be of the form:

f = k w (R, t) ⇐ k u (X, x), B 2 , . . . , B n .
Let f ′ be the statement obtained from f by applying Remove. We have that

f ′ = k w (R, t) ⇐ B 2 , . . . , B n .
By applying the induction hypothesis on f ′ and σ, we immediately obtain our conclusion:

k w (R, t)σ ∈ H e (K| solved ).
Lemma 5.19. Let K be a saturated knowledge base, let

f = k w (R, t) ⇐ B 1 , . . . , B n be a statement such that f ⇓ = k w (R ′ , t) ⇐ C 1 , . . . , C m for some R ′ , C 1 , . . . , C m and let R ′′ be a recipe such that g = k w (R ′′ , t) ⇐ C 1 , . . . , C m ∈ deriv(K| solved )
and such that

h = i w (R ′′ , R ′ ) ⇐ C 1 , . . . , C m ∈ K| solved .
Let σ be a substitution grounding for f such that B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n. Then we have that (k w (R, t))σ ∈ H e (K| solved ).

Proof. We prove the lemma by induction on the number of steps to reach the canonical form. If f is already in canonical form we have that R = R ′ , B 1 , . . . , B n = C 1 , . . . , C m and, by applying Proposition 5.2 to g and σ, we have that

k w (R ′′ , t)σ ∈ H(K| solved ).
Furthermore, as h ∈ K| solved and as the body of hσ are simple consequence of K| solved , we have that

i w (R ′′ , R ′ )σ ∈ H(K| solved ).
It immediately follows that

k w (R ′ , t)σ ∈ H e (K| solved ),
which is what we had the prove since R = R ′ .

Otherwise, there must be a canonicalization rule which can be applied to f . We distinguish between two cases:

1. If the Rename canonicalization rule can be applied, then f must be of the form:

f = k w (R, t) ⇐ k u (X, x), k uv (Y, x), B 3 , . . . , B n .
Let us consider the statement f ′ obtained by applying Rename to f :

f ′ = k w (R, t) ⇐ k u (X, x), B 3 , . . . B n {Y → X}.
By the definition of a statement, Y has at most one occurence in B 1 , . . . , B n and therefore we have that (B

1 , B 3 , . . . B n ){Y → X} = (B 1 , B 3 , . . . , B n ). Therefore (B 1 , B 3 , . . . B n ){Y → X}σ = (B 1 , B 3 , . . . , B n )σ.
We can therefore apply the induction hypothesis on f ′ and σ to obtain that k w (R, t){Y → X}σ ∈ H e (K| solved ).

(5.7)

But k u (X, x)σ ∈ H(K| solved ) and k uv (Y, x)σ ∈ H(K| solved ). By Lemma 5.17, we have that

i uv (X, Y )σ ∈ H(K| solved ). (5.8)
From Equation 5.7 and Equation 5.8 and as uv is a prefix of w by the definition of a statement, we conclude by Proposition 5.3 that

k w (R, t)σ ∈ H e (K| solved ).
2. If the Remove canonicalization rule can be applied, then f must be of the form:

f = k w (R, t) ⇐ k u (X, x), B 2 , . . . , B n .
Let f ′ be the statement obtained from f by applying Remove. We have that

f ′ = k w (R, t) ⇐ B 2 , . . . , B n .
By applying the induction hypothesis on f ′ and σ, we immediately obtain our conclusion:

k w (R, t)σ ∈ H e (K| solved ).
This lemma is the main lemma that shows completeness of the intruder knowledge predicate.

Lemma 5.20. Let K be a saturated knowledge base, let f ∈ K be a statement

f = k w (R, t) ⇐ B 1 , . . . , B n
and let σ be a substitution grounding for f such that B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n. Then we have that

(k w (R, t))σ ∈ H e (K| solved ).
Proof. Let G = i∈{1,...,n} S(B i σ, K| solved ). We prove the lemma by induction on G.

If f is a solved statement, the conclusion is trivial by the definitions of H, H e . Otherwise, there exists some B j = k wj (X j , t j ) (with 1 ≤ j ≤ n) such that t j ∈ X . As B j σ ∈ H(K| solved ), we have by Proposition 5.4 that there exist

g = k u ′ (R ′ , t ′ ) ⇐ B ′ 1 , . . . , B ′ m ∈ K| solved , a substitution σ ′ grounding for g such that B ′ 1 σ ′ , . . . , B ′ m σ ′ ∈ H(K| solved ), k u ′ (R ′ , t ′ )σ ′ = k u (X j , t j )σ for some prefix u ⊑ w j of w j and S(B j σ, K| solved ) > i∈{1,...,m} S(B ′ i σ ′ , K| solved ). As σ ∪ σ ′ is a unifier of k u (X j , t j ) and k u ′ (R ′ , t ′ ), it follows that τ = mgu(k u (X j , t j ), k u ′ (R ′ , t ′ )) exists. Let σ ∪ σ ′ must
be an instance of the most general unifier, let ω be a substitution such that σ ∪ σ ′ = τ ω.

As K is saturated, it follows that the Resolution saturation rule was applied to f and g. Let h be the resulting statement:

h = k w (R, t) ⇐ B 1 , . . . , B j-1 , B j+1 , . . . , B n , B ′ 1 , . . . , B ′ m τ.
We distinguish two cases:

1. if h is not solved we have that h ∈ K by the update function (as K is saturated).

We can therefore apply the induction hypothesis on h and on the substitution ω to immediately conclude.

2. if h is solved, we distinguish two cases:

(a) either h⇓ ∈ K, in which case we conclude by applying Lemma 5.18 to h and ω.

(b) or h⇓ = k w (R ′′ , t) ⇐ C 1 , . . . , C k and h ′ = k w (R ′′′ , t) ⇐ C 1 , . . . , C k ∈ deriv(K| solved ) and h ′′ = i w (R ′′′ , R ′′ ) ⇐ C 1 , . . . , C k ∈ K| solved
for some R ′′′ , in which case we conclude by applying Lemma 5.19.

The following proposition follows from the definition of H e .

Proposition 5.5.

If k u (R, t) ∈ H e (K), then k uv (R, t) ∈ H e (K). Proof. As k u (R, t) ∈ H e (K), it follows that k u (R ′ , t) ∈ H(K) and i u (R ′ , R) ∈ H e (K) for some R ′ .
By the ExtendK rule, we have that k uv (R ′ , t) ∈ H(K) and by the Extend rule, we have that i uv (R ′ , R) ∈ H e (K). We conclude by rule Equational Consequence that k uv (R, t) ∈ H e (K), which is what we had to show.

The following lemma shows completeness of the saturation procedure.

Lemma 5.21. Let K be a set of statements and let K ′ be the saturation of the knowledge base obtained by updating the empty knowledge base by each statement in K.

Then

H(K) ⊆ H e (K ′ | solved )
Proof. Let H ∈ H(K). We will prove by induction on the proof tree of H ∈ H(K) that each node of the tree is in H e (K ′ | solved ). We distinguish two cases:

1. if H = k w (R, t) and k u (R, t) ∈ H(K)
for some prefix u of w, in which case by the induction hypothesis we have that k u (R, t) ∈ H e (K ′ | solved ) and we conclude by Proposition 5.5.

if

H = i w (R, R ′ ) and i u (R, R ′ ) ∈ H(K) for some prefix u of w, we have that i u (R, R ′ ) ∈ H e (K ′ | solved
) by the induction hypothesis and therefore i w (R, R ′ ) ∈ H e (K ′ | solved ) by rule Extend.

3. otherwise there is a statement

f = H ′ ⇐ B ′ 1 , . . . , B ′ n ∈ K
and a substitution σ grounding for f such that H = H ′ σ and B ′ i σ ∈ H(K). By the induction hypothesis, we have that

B ′ i σ ∈ H e (K ′ | solved ). W.l.o.g. assume that B ′ i = k w ′ i (X i , t ′ i ). As B ′ i σ ∈ H e (K ′ | solved ), we have by definition of H e that there exist R ′ i such that k w ′ i σ (R ′ i , t i σ) ∈ H(K ′ | solved ), (5.9)
i w ′ i σ (R ′ i , X i σ) ∈ H e (K ′ | solved ) (5.10)
for all 1 ≤ i ≤ n.

But w ′ i σ is a prefix of w, where w is such that H = predicate w (. . .) with predicate ∈ {r, i, ri, k}. Therefore, by applying the Extend rule to Equation (5.10), we obtain

i w (R ′ i , X i σ) ∈ H e (K| solved ). (5.11)
Let σ ′ be the substitution defined to be σ except that it maps X i to R ′ i for all 1 ≤ i ≤ n. We will show that H ′ σ ′ ∈ H e (K ′ | solved ). As K ′ was updated by f , there are three cases: (a) if f ∈ K ′ , we conclude by Lemma 5.20, Lemma 5.13, Lemma 5.14 or Lemma 5.15.

(b) or f ⇓ ∈ K ′ and f ∈ K ′ , in which case f must be a solved deduction statement. In this case, by Lemma 5.18, we obtain that

H ′ σ ′ ∈ H e (K ′ | solved ). (c) or f ⇓ = k w (R, t) ⇐ C 1 , . . . , C m and there exists R ′ such that k w (R ′ , t) ⇐ C 1 , . . . , C m ∈ deriv(K ′ | solved ) and such that i w (R, R ′ ) ⇐ C 1 , . . . , C m ∈ K ′ | solved .
In this case, we have that H ′ σ ′ ∈ H e (K ′ | solved ) by Lemma 5.19.

We have shown that

H ′ σ ′ ∈ H e (K ′ | solved ). But H ′ σ ′ = H ′ {X i → R ′ i }σ and therefore H ′ {X i → R i }σ ∈ H e (K ′ | solved ). By Equation (5.11), we obtain that H ′ {X i → X i σ}σ = H ′ σ ∈ H e (K ′ | solved ),
which is what we had to show.

We can now combine the completeness of the initial set of seed statements with the complete of the saturation procedure to prove Theorem 5.3. ------→ (S, ϕ).

Let K be a saturated knowledge base associated to T , i.e., K = sat(K i (T )). Then we have that 1. r L1ϕ↓,...,Lnϕ↓ ∈ H e (K| solved ),

2. if ϕ ⊢ R t then k L1ϕ↓,...,Lnϕ↓ (R, t↓) ∈ H e (K| solved ) and 3. if ϕ ⊢ R t and ϕ ⊢ R ′ t, then i L1ϕ↓,...,Lnϕ↓ (R, R ′ ) ∈ H e (K| solved ).
Proof. The first two items are immediate consequences of Lemma 5.2 and of Lemma 5.21.

The third item follows immediately from the second item and Lemma 5.17.

Correctness of the Trace Inclusion Algorithm

This section is dedicated to proving Theorem 5.4. In order to prove it, we need a few technical lemmas.

First we show that each intruder reachability statement and each deduction statement in the saturated knowledge base has a certain form. Lemma 5.22. Let T be a trace and let K be a saturated knowledge base associated to T . Then for any statement f ∈ K, we have that:

1. if f = r l1,...,ln ⇐ {k wi (X i , t i )} i∈{1,...,m} and x ∈ Var (l k ) then there exists w j = l 1 , . . . , l k ′ with k ′ < k such that x ∈ Var (t j ).

2. if f = k l1,...,ln (R, t) ⇐ {k wi (X i , t i )} i∈{1,...,m} and x ∈ Var (t) then x ∈ Var (t 1 , . . . , t m ).

Proof. The seed knowledge base satisfies the above properties and they are preserved by canonicalization, update and saturation.

The next lemma states that by extending a frame, we keep all existing deductions. Lemma 5.23. If Dom(ϕ) ⊆ Dom(ϕ ′ ) and ϕ ⊢ r t, then ϕ ′ ⊢ r t.

Proof. The same rewrite steps to obtain t from rϕ are used to obtain t from rϕ ′ . We now show that operational semantics is stable by replacement of names with recipes.

Lemma 5.24. Let T 0 be a trace, ϕ 0 = ∅ the empty frame, and {c 1 , . . . , c k } public names such that c i ∈ N ames(T 0 ) for all

1 ≤ i ≤ k. If (T 0 , ϕ 0 ) L1 = = ⇒ (T 1 , ϕ 1 ) L2 = = ⇒ . . . Ln = = ⇒ (T n , ϕ n ) and ∀1 ≤ i ≤ k • either c i ∈ N ames(L 1 , . . . , L n ) • or ϕ idx(ci)-1 ⊢ Ri t i for some t i where idx(c i ) = min{j | c i ∈ N ames(L j )}
1. either (P, ∅) M1,...,Mn ======⇒ ( , ), in which case, by the soundness of K, we have that (T, ∅) M1,...,Mn ------→ ( , ) and therefore T ⊑ P .

2. or for any ϕ ′ such that (P, ∅) M1,...,Mn ======⇒ ( , ϕ ′ ) we have (Rπ = R ′ π)ϕ ′ . By the soundness of K, we have however that (T, ∅) M1,...,Mn ------→ ( , ϕ) and (Rπ = R ′ π)ϕ. Therefore T ⊑ P .

Next, we prove that if T ⊑ P , then at least one test fails. We assume by contradiction that T ⊑ P , that all tests pass and we derive a contradiction.

As T ⊑ P , it follows that there exist L 1 , . . . , L n , ϕ such that either:

(T, ∅) L1,...,Ln ------→ (T ′ , ϕ) and
∀S ∈ P : (S, ∅) L1,...,Ln = ===== ⇒ (S ′ , ψ)
or:

(T, ∅) L1,...,Ln ------→ (T ′ , ϕ) and (R = R ′ )ϕ and

∀S ∈ P, (S, ∅) L1,...,Ln = ===== ⇒ (S ′ , ψ) implies (R = R ′ )ψ
Let n be the smallest index such that one of the above holds. We then have that:

(T, ∅) L1 --→ (T 1 , ϕ 1 ) L2 --→ . . . Ln-1 ---→ (T n-1 , ϕ n-1 ) Ln --→ (T n , ϕ n )
and there exists S ∈ P such that:

(S, ∅)

L1 = = ⇒ (S 1 , ψ 1 ) L2 = = ⇒ . . . Ln-1 ===⇒ (S n-1 , ψ n-1 ), such that for all R, R ′ we have (R = R ′ )ϕ i =⇒ (R = R ′ )ψ i (1 ≤ i ≤ n -1
) and:

1. either for all U ∈ P we have (U, ∅) L1,...,Ln = ===== ⇒ ( , ψ)

2. or there exist recipes R, R ′ such that for any U ′ ∈ P such that (U ′ , ∅)

L1,...,Ln = ===== ⇒ ( , ψ ′ ) we have (R = R ′ )ψ ′ .
We consider each of the cases separately:

1. If we are in the case of Item 1, as (T, ∅) L1,...,Ln ------→ (T n , ϕ n ), we have by Theorem 5.3 that r L1ϕn↓,...,Lnϕn↓ ∈ H e (K). By the definition of H e , we have that it contains no reachability statements in addition to those in H: therefore r L1ϕn↓,...,Lnϕn↓ ∈ H(K).

Therefore there exist a statement f = r l1,...,ln ⇐ k wi (X i , x i ) i∈{1,...,m} ∈ K and a substitution τ grounding for f such that

l i τ = L i ϕ n ↓ (for all 1 ≤ i ≤ n) and such that k wiτ (X i τ, x i τ ) ∈ H(K).
Let c 1 , . . . , c k be fresh public names and let σ : Var (l 1 , . . . , l n ) → {c 1 , . . . , c k } be a bijection.

As k ℓ1,...,ℓ |w i | (c j , c j ) ⇐ ∈ K(T ) for all 1 ≤ i ≤ m and all 1 ≤ j ≤ k and w i σ is an instance of ℓ 1 , . . . , ℓ |wi| , it follows by Theorem 5.3 that there exists a substitution σ ′ such that k wiσ (X i σ ′ , x i σ) ∈ H e (K) for all 1 ≤ i ≤ m, which implies by the definition of H e that there exists a substitution σ ′′ such that k wiσ (X i σ ′′ , x i σ) ∈ H(K) for all 1 ≤ i ≤ m.

By instantiating f with σ ∪ (σ ′′ [{X 1 , . . . , X m }]), we obtain that r l1σ,...,lnσ ∈ H(K). By the soundness of K and of H, it follows that T |= r l1σ,...,lnσ . Therefore, there exist recipes R ′ i (for all 1 ≤ i ≤ n such that l i = receive( , t i )) such that T |= k l1σ,...,li-1σ (R ′ i , t i σ). By the completeness of K, it follows that there exist recipes R i such that k l1σ,...,li-1σ (R i , t i σ) ∈ H(K).

Let M i = l i if l i ∈ {test, send( )} and let M i = receive(d i , R i ) if l i = receive(d i , t i ) for all 1 ≤ i ≤ n.
Because the Reachability test worked, it follows that there exists S ′ 0 ∈ P such that, if we let ψ ′ 0 = ∅, we have

(S ′ 0 , ψ ′ 0 ) M1 = = ⇒ (S ′ 1 , ψ ′ 1 ) M2 = = ⇒ . . . Mn = = ⇒ (S ′ n , ψ ′ n ).
We already have that k wj τ (X j τ, x j τ ) ∈ H(K) by choice of f and of τ . By the soundness of H and K, we obtain T |= k wj τ (X j τ, x j τ ). By Lemma 5.22, we have that |w j | < i, and as w j is a prefix of l 1 , . . . , l i-1 , we have that T |= k l1τ,...,li-1τ (X j τ, x j τ ).

Let π : {c 1 , . . . , c k } → T (F, N , M) and π ′ : {c 1 , . . . , c k } → T (F, M, W) be defined such that π(c l ) = x j τ and π ′ (c l ) = X j τ when σ(x j ) = c l . As X j τ = c l π ′ , x j τ = c l π and l 1 τ, . . . , l i-1 τ = l 1 σπ, . . . , l i-1 σπ therefore we have that T |= k l1σπ,...,li-1σπ (c l π ′ , c l π).

We also have that k l1σ,...,li-1σ (R i , t i σ) ∈ H(K). By the soundness of H and K, we have that T |= k l1σ,...,li-1σ (R i , t i σ). We apply Lemma 5.25 to obtain that T |= k l1σπ,...,li-1σπ (R i π ′ , t i σπ). But t i σπ = t i τ and l 1 σπ, . . . , l i-1 σπ = l 1 τ, . . . , l i-1 τ and therefore we have that

T |= k l1τ,...,li-1τ (R i π ′ , t i τ ).
Let R ′′ i be such that L i = receive(d i , R ′′ i ) for some channel d i for all i such that the ith action of T is a receive. By the definition of |=, we have therefore that

T |= k l1τ,...,li-1τ (R ′′ i , t i τ ). We conclude that T |= i l1τ,...,li-1τ (R i π ′ , R ′′ i ), or, equivalently, (R i π ′ = R ′′ i )ϕ i-1
. By the hypothesis, we have that (R i π ′ = R ′′ i )ψ i-1 as well. From Lemma 5.24, we obtain that

(S ′ 0 , ψ ′ 0 ) = (S ′ 0 π, ψ 0 π) M1π ′ ===⇒ (S ′ 1 π, ψ ′ 1 π) M2π ′ ===⇒ . . . Mnπ ′ ===⇒ (S ′ n π, ψ ′ n π).
We will show by induction on n that (S ′ 0 π, ψ 0 π)

L1 = = ⇒ (S ′ 1 π, ψ ′ 1 π) L2 = = ⇒ . . . Ln = = ⇒ (S ′ n π, ψ ′ n π).
We assume by the induction hypothesis that

(S ′ 0 π, ψ 0 π) L1 = = ⇒ (S ′ 1 π, ψ ′ 1 π) L2 = = ⇒ . . . Li =⇒ (S ′ i π, ψ ′ i π)
and we show that

(S ′ i π, ψ ′ i π) Li+1 = == ⇒ (S ′ i+1 π, ψ ′ i+1 π).
We will show that L i+1 and M i+1 π ′ satisfy the conditions of Lemma 5.26 and then we can easily conclude by it. Indeed, either L i+1 = M i+1 π ′ (in the case of a test or send action), or

L i+1 = receive(d i+1 , R ′′ i+1 ) and M i+1 π ′ = receive(d i+1 , R i+1 π ′ ) (in
the case of a receive action). In the second case, as we have shown (R i+1 π ′ = R ′′ i+1 )ψ i , by determinacy of P it follows that ψ i π ≈ s ψ ′ i π and therefore (R i+1 π ′ = R ′′ i+1 )ψ ′ i as well. As the hypothesis of Lemma 5.26 are satisfied, we can conclude.

Let U = S ′ 0 . We have shown that (U, ∅) L1,...,Ln = ===== ⇒ ( , ), therefore obtaining a contradiction. Therefore Item 1 cannot hold.

2. In the case of Item 2, we assume that for all U ∈ P such that (U, ∅) L1,...,Ln = ===== ⇒ ( , ψ) we have (R = R ′ )ψ to obtain a contradiction.

As (R = R ′ )ϕ n , it follows by Theorem 5.3 that i L1ϕn↓,...,Lnϕn↓ (R, R ′ ) ∈ H e (K).

As (R = R ′ )ψ it follows that there exist recipes Q, Q ′ such that i L1ϕn↓,...,Lnϕn↓ (Q, Q ′ ) ∈ H(K) but (Q = Q ′ )ψ.
As r L1ϕn↓,...,Lnϕn↓ ∈ H(K), we have by Lemma 5.16 that ri L1ϕ↓,...,Lnϕ↓ (Q, Q ′ ) ∈ H(K). Therefore there exists a statement f = ri l1,...,ln (P, P ′ ) ⇐ {k wi (X i , x i )} i∈{1,...,m} ∈ K and a substitution τ grounding for f such that k wiτ (X i τ,

x i τ ) ∈ H(K) (for all 1 ≤ i ≤ m), l 1 τ, . . . , l n τ = L 1 ϕ n ↓, . . . , L n ϕ n ↓, P τ = Q and P ′ τ = Q ′ .
Let c 1 , . . . , c k be fresh public names and let σ : Var (l 1 , . . . , l n ) → {c 1 , . . . , c k } be a bijection. As k ℓ1,...,ℓ |w i | (c j , c j ) ⇐ ∈ K(T ) for all 1 ≤ i ≤ m and all 1 ≤ j ≤ k and w i σ is an instance of ℓ 1 , . . . , ℓ |wi| , it follows by Theorem 5.3 that there exists a substitution σ ′ such that k wiσ (X i σ ′ , x i σ) ∈ H e (K) for all 1 ≤ i ≤ m, which implies by the definition of H e that there exists a substitution σ ′′ such that k wiσ (X i σ ′′ , x i σ) ∈ H(K) for all 1 ≤ i ≤ m.

By instantiating f with σ ∪ (σ ′′ [{X 1 , . . . , X m }]), we obtain that r l1σ,...,lnσ ∈ H(K). By the soundness of K and of H, it follows that T |= r l1σ,...,lnσ . Therefore, there exist recipes

R ′ i (for all 1 ≤ i ≤ n such that l i = receive( , t i )) such that T |= k l1σ,...,li-1σ (R ′ i , t i σ)
. By the completeness of K, it follows that there exist recipes R i such that k l1σ,...,li-1σ (R i , t i σ) ∈ H(K).

Let M i = l i if l i ∈ {test, send( )} and let M i = receive(d i , R i ) if l i = receive(d i , t i ) for all 1 ≤ i ≤ n.
Because the Reachability test worked, it follows that there exists S ′ 0 ∈ P such that, if we let ψ ′ 0 = ∅, we have

(S ′ 0 , ψ ′ 0 ) M1 = = ⇒ (S ′ 1 , ψ ′ 1 ) M2 = = ⇒ . . . Mn = = ⇒ (S ′ n , ψ ′ n ).
Similarly to Item 1, we can show that there exists S ′ 0 ∈ P such that

(S ′ 0 , ψ ′ 0 ) = (S ′ 0 π, ψ 0 π) L1 = = ⇒ (S ′ 1 π, ψ ′ 1 π) L2 = = ⇒ . . . Ln = = ⇒ (S ′ n π, ψ ′ n π
) where π and π ′ are defined as in Item 1.

Furthermore, as the Identity test worked, it follows that (P ω = P ′ ω)ψ ′ n , where ω = {X i → x i σ}. As the equational theory is stable by substitution of terms for names, we have that (P ωπ ′ = P ′ ωπ ′ )ψ ′ n π. But P ωπ ′ = P τ = Q and

P ′ ωπ ′ = P ′ τ = Q ′ , which means that (Q = Q ′ )ψ ′ n π.
We have shown that there exists S ′ 0 ∈ P such that (S ′ 0 , ∅)

L1,...,Ln = ===== ⇒ ( , ψ ′ n π) and (Q = Q ′ )ψ ′ n π
. By determinacy of P , it follows that (Q = Q ′ )ψ for any ψ and any U ∈ P such that (U, ∅) L1,...,Ln = ===== ⇒ ( , ψ), therefore we obtain a contradiction.

As both cases yield a contradiction, it follows that if T ⊑ P , there exists at least one test that fails.

Tool Support and Termination

We conjecture that our saturation procedure always terminates. Unfortunately, we have not been able to prove this due to the highly complex form of the statements that are obtained during saturation.

We have however implemented the saturation procedure and the trace inclusion checking procedure in the tool AKiSs (Active Knowledge in Security protocols). The tool AKiSs is written in OCaml and has around 2500 lines of source code, including code for computing strongly complete sets of finite variants and complete sets of equational unifiers for optimally reducing convergent equational theories (as described in Chapter 3).

The tool AKiSs takes as input two processes P and Q in the form of a set of traces P = {S 1 , . . . , S n } and Q = {T 1 , . . . , T m }. It then tries to check if the two processes are coarse trace equivalent. There are three possible results:

1. the tool does not terminate, in which case we cannot draw any conclusion. We conjecture that this situation never happens for subterm convergent rewrite systems (i.e. that AKiSs always terminates for such rewrite systems). However, due to the highly complex forms of the statements generated during the saturation process, we have not been able to prove it.

2. the tool terminates, tells that P ≈ c Q and outputs a proof of non-trace-equivalence in the form of a sequence of labels l 1 , . . . , l n and two recipes r and r ′ such that (P, ∅) l1,...,ln ----→ (S ′ , ϕ), (r = r ′ )ϕ and either (Q, ∅) l1,...,ln ====⇒ (T ′ , ϕ ′ ) or for any ϕ ′ such that (Q, ∅) l1,...,ln ====⇒ (T ′ , ϕ ′ ) we have (r = r ′ )ϕ ′ (or vice-versa, the roles of P and Q being swapped).

In this case, we are sure that P ≈ t Q since P ≈ t Q implies P ≈ c Q (and we can hand-check the proof).

3. the tool terminates, tells that P ≈ c Q. There are two possibilities:

(a) either P and Q are determinate, in which case by the correctness proof P ≈ t Q by Theorem 5.1, (b) or at least one of P and Q is not determinate, in which case there is no guarantee.

Handling Non-determinate Processes

The above has a significant weakness: it does not allow to conclude that two processes which are not known to be determinate are equivalent. In order to circumvent this weakness, we propose in Figure 5.4 a sound way of checking (in)equivalence of two processes P = {S 1 , . . . , S n } and Q = {T 1 , . . . , T m } which are not known to be determinate. Unfortunately, the procedure is not complete in the sense that there are non-determinate processes P and Q for which we cannot conclude that P ≈ t Q or that P ≈ t Q.

1. run AKiSs to check if P ≈ c Q. If AKiSs shows that P ≈ c Q, then the two processes are not trace equivalent.

2. otherwise, run AKiSs to check if S i ≈ c T j for every trace S i ∈ P and every trace T j ∈ Q. Since any individual trace S i (or T j ) is determinate, we have by Theorem 5.1 that S i ≈ c T j iff S i ≈ t T j and therefore AKiSs will soundly determine if S i ≈ t T j or not.

It for every i ∈ {1, . . . , n} there exists a j ∈ {1, . . . , m} such that S i ≈ t T j (and vice-versa, for every j ∈ {1, . . . , m} there exists an i ∈ {1, . . . , n} such that S i ≈ t T j ), then it easily follows that P ≈ t Q.

3. otherwise, AKiSs cannot prove anything about P and Q and therefore some other technique needs to be used to show trace (in)equivalence of P and Q. We refer the reader to Example 5.4 for an example of two non-determinate processes that AKiSs cannot prove to be equivalent or inequivalent. This is because the two processes are coarse trace equivalent, but not trace equivalent. However, in our experiments on security protocols, we have not encountered such as situation (i.e. AKiSs was able to prove or dis-prove all equivalences for the examples that we have tried).

Also, on all our experiments with subterm convergent rewrite systems, the saturation process always terminated. We explain in the following sections some of our experiments.

The Running Example

The running example, consisting of the following traces

T = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(dec(x, k), k)].send(c, ok) S 1 = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(a, k)].send(c, ok) S 2 = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(a ′ , k)].send(c, ok)
where a, a ′ , k ′ ∈ N are private names, where ok ∈ M is a public name and where c ∈ C is a public channel is interesting because it illustrates a subtlety of trace equivalence: even if the processes T and {S 1 , S 2 } are trace equivalent, note that the trace T is trace-included neither in S 1 nor in S 2 . However, T is included in the process consisting of both traces (S 1 and S 2 ).

This shows that even if two processes are trace-equivalent, there might be symbolic traces of the first process which are not included in any of the individual symbolic traces of the other process. Rather, the second process as a whole trace-includes each symbolic trace of the first process.

It can be easily proved that {S 1 , S 2 } is a determinate process. Therefore our tool can directly prove that T ≈ t {S 1 , S 2 }. When given as input the two processes (T on one side and {S 1 , S 2 } on the other side), it terminates instantaneously and proves their trace-equivalence.

When asked to check for the equivalence between T and either S 1 or S 2 , the tool immediately shows that the two are not trace-equivalent and provides an appropriate counter-example.

If we did not know that {S 1 , S 2 } is determinate, we could have used the workflow described in Figure 5.4 to check if {S 1 , S 2 } and T are trace-equivalent or not. Unfortunately, since neither S 1 nor S 2 is trace-equivalent to T , we would not have been able to draw any conclusion.

The FOO E-voting Protocol

In this section we analyze vote privacy in a voting protocol (from hereon referred to as the 'FOO protocol') due to Fujioka, Okamoto and Ohta [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF]. We provide an informal description of the protocol and we then proceed to show that it satisfies vote privacy in our symbolic model.

Description

The FOO voting protocol relies on two relatively non-standard cryptographic primitives:

1. commitments: by constructing the message commit(v, r) for some value v and some key r and sending it to some party, a participant commits to the value v with respect to the party having received the commitment.

The commitment itself does not reveal the value v or the key r.

Later on, when the participant is ready to reveal the value v to which he has previously commited, he sends in clear the key r to the other party. This party can nowopen the commitment with the key r obtaining open(commit(v, r), r) = E v and obtain the value that was commited to.

2. blind signatures: a participant who wants to have an authority sign some message m, but without revealing the contents of m to the authority, can first blind the message m with a random blinding factor B to obtain blind(m, b).

The authority can then sign the blinded message (if it chooses to do so) using its private key k to obtain sign(blind(m, b), k). Later on, the participant can use the blinding factor to unblind the message signed by the authority, thereby obtaining unblind(sign(blind(m, b), k), b) = E sign(m, k) the signature of the authority on the unblinded message.

We have briefly described the cryptographic primitives involved. We now describe how the protocol works. The voting takes place in three phases described bellow.

1. In the first phase, each voter V chooses a vote v, computes a commitment commit(v, r) of the vote v with a fresh key r, blinds the commitment using a random blinding factor b (obtaining blind(commit(v, r), b) and signs the result with his private key, thereby obtaining the blob sign(blind(commit(v, r), b), k V ).

The voter then sends this blob to an administrator accompanied by V 's identity. The administrator verifies that V has the right to vote and did not vote before, and then signs using the administrator signature the blob (the blob is not signed by V at this point) and sends the result sign(blind

(commit(v, r), b), k A ) to V .
Once the voter V receives this message (presumably the signature of the administrator on his blinded vote), he then performs atomically the following actions: it checks that it was the administrator who has signed the received message (using the administrator's public key) and then unblinds that message to obtain unblind(sign(blind

(commit(v, r), b), k A ), b) = E sign(commit(v, r), k A ), i.e.
his own commitment signed by the administrator. Note that in this process, V did not reveal his vote to the administrator.

2. The second phase is the actual voting phase: V sends the unblinding to the collector C on an anonymous channel, the collector verifies that the unblinding was signed by the administrator and, if the test succeeds, enters the commitment and the unblinding into the database.

3. The third and last phase starts once the collector decides it has received all votes (i.e. after the election ends).

The collector publishes the database of votes. Each voter V verifies that their commitment is in the list and if so sends r, the commitment factor, to C via an anonymous channel.

The collector C opens each ballot with the random r and publishes the vote v.

Modeling and Verifying the Protocol

To model the commitment scheme and the blind signatures, we use the following convergent optimally reducing term rewriting system:

R =  
 open(commit(x, y), y) → x check(sign(x, y), pk(y)) → x unblind(sign(blind(x, y), z), y), pk(z)) → sign(x, z)    that models the cryptographic primitives used in this case. As we do not trust any of the election authorities, we assume they are dishonest participants and we give away their private key to the attacker by modeling the private key k auth ∈ M of the authority as a public name. We model a voter V ∈ {A, B} ⊆ C (we identity voters with channels) voting v ∈ {yes, no} ⊆ M (each vote is represented by a public name) by a trace

P (V, v) = A 1 (V, v).A 2 (V, v).A 3 (V, v).A 4 (V, v)
where

A 1 (V, v) = send(V, sign(blind(commit(v, r V,v ), b V,v ), k V )) A 2 (V, v) = receive(V, x V,v ).[checksign(x V,v , pk(k auth )) = blind(commit(v, r V,v ), b V,v )] A 3 (V, v) = send(c, unblind(x V,v , b V,v )) A 4 (V, v) = send(c, r V,v )
are the atomic actions of the honest participants. The names b V,v , r V,v ∈ N are private, V ∈ {A, B} is the channel of voter V and c ∈ C is a public channel (so that the signed commitment can be transmitted anonymously). The actions A 1 and A 2 correspond to the first phase of the protocol, the action A 3 corresponds to the second phase and the action A 4 to the third phase.

Different voting situations can then be considered by constructing interleavings of traces P (V, v) for several values of V and v in a phase-respecting manner. To prove that an attacker cannot tell the difference between the situation where agent A votes yes and agent B votes no from the situation where the two agents swap their votes: agent A votes no and agent B votes yes, we consider the set Σ(V, v, U, u) to contains all 24 traces resulting from phase-respecting interleavings of P (V, v) and P (U, u) as defined in Figure 5.5. We next consider a process modeling all traces of the FOO protocol restricted to two honest participants: a participant V who votes v and another participant U who votes u:

Phase 1 (V, v, U, u) = { A 1 (V, v).A 2 (V, v).A 1 (U, u).A 2 (U, u) A 1 (V, v).A 1 (U, u).A 2 (V, v).A 2 (U, u) A 1 (V, v).A 1 (U, u).A 2 (U, u).A 2 (V, v) A 1 (U, u).A 1 (V, v).A 2 (V, v).A 2 (U, u) A 1 (U, u).A 1 (V, v).A 2 (U, u).A 2 (V, v) A 1 (U, u).A 2 (U, u).A 1 (V, v).A 2 (V, v) } Phase 2 (V, v, U, u) = { A 3 (V, v).A 3 (U, u) A 3 (U, u).A 3 (V, v) } Phase 3 (V, v, U, u) = { A 4 (V, v).A 4 (U, u) A 4 (U, u).A 4 (V, v) } Σ(V, v, U, u) = { P 1 .P 2 .P 3 | P 1 ∈ Phase 1 , P 2 ∈ Phase 2 , P 3 ∈ Phase 3 , }
Q(V, v, U, u) = {send(c, pk(k A )).send(c, pk(k B )).T | T ∈ Σ(V, v, U, u)}.
In addition to the set of traces Σ(V, v, U, u), the process Q(V, v, U, u) also models the fact that the intruder has the public keys of the honest agents. In order to check that the FOO protocol satisfies vote privacy for two participants in our symbolic model, it is sufficient to establish (similarly to [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]) that Q(A, yes, B, no) ≈ t Q(A, no, B, yes).

Unfortunately, we cannot directly apply our tool AKiSs to check trace equivalence because the two processes Q(A, yes, B, no) and Q(A, no, B, yes) are not determinate. However, the sufficient condition described in the second step of Figure 5.4 holds, i.e. AKiSs shows in a little under 3 minutes that for any trace T ∈ Q(A, yes, B, no) there exists S ∈ Q(A, no, B, yes) such that T ≈ t S and vice-versa and therefore

Q(A, yes, B, no) ≈ t Q(A, no, B, yes).
We conclude that the FOO voting protocol indeed satisfies vote privacy in our symbolic model. Note that our model only accounts for two voters and two votes. However, the same methodology can be used to establish vote privacy results for several voters and several possible votes (at the cost of an increase in running time).

Checking for Strong Secrecy

Usually, secrecy is checked in the Dolev-Yao model as a reachability property [START_REF] Millen | Constraint solving for bounded-process cryptographic protocol analysis[END_REF]. However, it is possible to define stronger forms of secrecy in the Dolev-Yao model based on process equivalences.

Blanchet [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF] provides such a definition of strong secrecy based on observational equivalence in a variant of the applied-pi calculus. According to Blanchet [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF], a process P (x) with a set of free variables x preserves the strong secrecy of its free variables x if and only if, for all grounding substitutions σ, σ ′ of domain x, we have P σ ≈ P σ ′ .

In the above definition, the substitution application avoids name capture (i.e. σ, σ ′ are not allowed to contain private names). Also, by the definition of [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF], ≈ denotes observational equivalence. We can model the same type of strong secrecy in our process calculus, but relying on trace equivalence instead of observational equivalence: Definition 5.14. Let P be a process with free variables {x 1 , . . . , x n }. The process P satisfies strong secrecy of its free variables if and only if: receive(c, x 1 ). . . . .receive(c, x n ).receive(c, x ′ 1 ). . . . .receive(c, x ′ n ).P ≈ t receive(c, x 1 ). . . . .receive(c, x n ).receive(c, x ′ 1 ). . . . .receive(c, x ′ n ).P

{x i → x ′ i } 1≤i≤n ,
where c ∈ C is a public channel.

We can see that the two definitions (the one from [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF] and Definition 5.14) coincide (other than the change from ≈ to ≈ t ) by noting that the universal quantification on σ, σ ′ and the fact that σ, σ ′ do not capture private names are modeled by having the intruder choose the values of x 1 , . . . , x n , x ′ 1 , . . . , x ′ n at the beginning of each process. We consider the running example from [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF], a key-distribution protocol:

A → B : aenc(sign(pair(pk A , pair(pk B , k)), sk A ), pk B ) B → A : enc(x, k).

In this protocol, the two participants A and B wish to establish a shared key k for subsequent communication. The participant A creates the key k, and sends it to B together with the identity pk A of A and pk B of B. The entire message is signed by A using his private key sk A and encrypted under the public key pk B of B. The participant B can then send to A a message enc(x, k) encrypted under the freshly created key k. The variable x is free and represents the contents of the message. We will next analyze the strong secrecy of x in this protocol.

We model the cryptographic primitives used (public key encryption, digital signatures, symmetric encryption and pairs) in a standard fashion using the following convergent optimally reducing term rewriting system R: R = { adec(aenc(x, pk(y)), y) → x dec(enc(x, y), y) → x checksign(sign(x, y), pk(y)) → ok msg(sign(x, y)) → x fst(pair(x, y)) → x snd(pair(x, y)) → x }.

We model one session of this protocol as follows. We let k, sk B , sk A ∈ N by private names representing the freshly chosen symmetric k and respectively the secret keys of A and of B. We consider a single public channel c ∈ C and two processes P A = send(c, aenc(sign(pair(pk(sk A ), pair(pk(sk B ), k)), sk A ), pk(sk B ))) P B (x) = receive(c, y). modeling the actions of participant A communicating to B and that of participant B communicating to A. We denote by P (x) all 6 interleavings of actions of P A and of P B (x). The strong secrecy of x (for one session of the protocol) is then modeled by the following equivalence: receive(c, x).receive(c, x ′ ).send(c, pk(sk A )).send(c, pk(sk B )).P (x) ≈ t receive(c, x).receive(c, x ′ ).send(c, pk(sk A )).send(c, pk(sk B )).P (x ′ ).

Sending pk(sk A ) and pk(sk B ) on the network models the fact that the intruder has the public keys of A and of B. Inputting x and x ′ follows our definition of strong secrecy (Definition 5.14). The notation a.P where a is an action and P is a process denotes the process {a.T | T ∈ P is a trace of P }.

We have checked the above equivalence using AKiSs and we have proved that it holds. We conclude that this protocols satisfies strong secrecy of x (for one session). We have also checked strong secrecy for the different variations of this protocol described in [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF]. The variations introduce violations of strong secrecy and fixes for these violations in order to re-obtain strong secrecy. We obtained using AKiSs the expected results (but for only one session of the protocol).

Checking for Guessing Attacks

We can distinguish secrets used in cryptographic protocols as being weak secrets and strong secrets. Strong secrets such as encryption keys have a bit-length which makes it intractable for an attacker to completely enumerate them. In contrast, weak secrets such as PINs or passwords can be enumerated in a more reasonable time-frame (e.g. assuming that a password is an English word, it is sufficient to enumerate all words in an English dictionary). Weak secrets are useful as they are easier to remember by humans. They are used for example to authenticate two participants as the following example protocol shows:

A → B : enc(n, w) B → A : enc(h(n), w).
In this protocol, the participants A and B share a weak secret w. The goal of the protocol is to authenticate B from A's point of view. To do this, A picks a fresh name n and send a challenge enc(n, w) to B. If B knows w, he can decrypt the challenge, compute the hash h(n) of the name n freshly chosen by A and encrypt the hash h(n) with w to send it to A. The participant A can then check that the decryption of what he received is the hash of the fresh name. In this case, A is convinced to be talking to B, since B has "proved" by decrypting and encrypting with w that we knows the weak secret w.

Suppose that an intruder records all of the messages ϕ = {w 1 → enc(n, w), w 2 → enc(h(w), w)} transmitted in a session between A and B. As w is a weak secret, he can enumerate all of the possible values v of w offline (i.e. after the session has ended). He can then check if a value v is the correct one (i.e. is equal to w) by performing the following test:

h(dec(w 1 , v)) ? = dec(w 2 , v).
When v = w, the test will succeed and when v = w, the test will fail. Therefore we say that the protocol makes w vulnerable to a guessing attack (or equivalently to an off-line dictionary attack). We can model that a private name w appearing in a process P is resistant against an offline dictionary attack by the following equivalence: P.send(c, w) ≈ t P.send(c, v).

In the above equivalence c ∈ C is a public channel, w, v ∈ N are private names with w representing the weak secret and v being a fresh name. The notation P.a where P is a process and a is an action denotes the process {T.a | T ∈ P is a trace of P }. The intuition behind the equivalence is that the attacker first records all messages output by P . Then he tries to guess the value of w (by enumerating all its values). This guessing is modeled by the two actions send(c, w) and send(c, v). If the two sides of the equivalence are indistinguishable, it means that the attacker has no test to distinguish between the real value w of the weak secret and another value v.

We now proceed to analyze resistance against guessing attacks for the example protocol that we have described above. We can model the roles of A and of B in the above protocol as the following traces:

P A = send(c, enc(n, w)) P B = receive(c, x).send(c, enc(h(dec(x, w)), w)).

The participant A therefore simply sends the encryption of a fresh name n ∈ N with the weak secret w ∈ N on the network. The participant B reads x (the message that A supposedly sent) from the network and outputs on the network the solution to A's challenge. We model the underlying rewrite system as R = { dec(enc(x, y), y) → x enc(dec(x, y), y) → x }.

The first equation is standard and the second equation models that the encryption scheme is not key revealing (otherwise there would be a trivial attack: the attacker could test w 1 is an encryption with the value v that he has guessed: enc(dec(w 1 , v), v) = w 1 ). Resistance against guessing attacks of w then reduces to the equivalence P.send(c, w) ≈ t P.send (c, v) where v ∈ N is a fresh name. The tool AKiSs shows that the two processes are not coarse trace equivalent (and therefore not trace equivalent) and outputs the following test which holds when X = P.send(c, w) but does not hold when X = Q.send(c, v): ----------------------------→ (Y, ϕ Therefore the equivalence does not holds and we conclude that P is not resistant against guessing attacks of w. We now consider a variant of the EKE protocol [START_REF] Bellovin | Encrypted key exchange: Password-based protocols secure against dictionary attacks[END_REF]:

(X, ∅)
A → B : enc(pk(k), w) B → A : enc(aenc(r, pk(k)), w).

The goal of the EKE protocol is to establish a session key r between two participants who share a weak secret w. To do so, the initiator A generates a fresh private key k and sends to B the associated public key pk(k) encrypted under w. The participant B then creates the fresh session key r and send this key to A wrapped by asymmetrically encrypting it with pk(k) and then symmetrically with w. In the EKE protocol a challenge-response phase meant to prevent replay attacks follows but we do not model it since we concentrate on resistance against guessing attacks on w. We model the two participants as the following traces P A = send(c, enc(pk(k), w)) P B = receive(c, x).send(c, enc(aenc(r, dec(x, w)), w)), where c ∈ C is a public channel and r, k, w ∈ N are private names. Then an interleaving of P A and P B represents one session of the EKE protocol. We consider two more traces:

P ′ A = send(c, enc(pk(k ′ ), w)) P ′ B = receive(c, x ′
).send(c, enc(aenc(r ′ , dec(x ′ , w)), w)), with r ′ , k ′ ∈ N modeling a second session of the same protocol. Then the process P consisting of all interleavings of P A , P B , P ′ A , P ′ B model two concurrent sessions of the EKE protocol between participants A and B. We consider the term rewriting system R = { dec(enc(x, y), y) → x enc(dec(x, y), y) → x adec(aenc(x, pk(y)), y) → x }.

The first and the third rewrite rules are standard. The second rewrite rule models the fact that the symmetric encryption scheme is key-concealing to prevent an attacker from checking if a ciphertext has been encrypted using a known key. We have shown using AKiSs that P.send(c, w) ≈ t P.send(c, v) for a fresh private name v ∈ N and we can therefore conclude that EKE satisfies resistance against guessing attacks on w for two sessions.

Conclusion and Further Work

This chapter of the thesis is concerned with the verification of trace equivalence for security protocols. We obtain a procedure for verifying trace equivalence for finite, determinate processes without else branches under convergent optimally reducing rewrite systems. To handle non-determinate processes, we present an effective proof method for trace equivalence based on the procedure for determinate processes. We conjecture that the procedure always terminates for subterm convergent term rewriting systems, but unfortunately, due to the highly complex form of Horn clauses obtained by the procedure, we have not been able to prove this.

We have implemented this procedure in the tool AKiSs and we have used the procedure to run several experiments. Although the implementation works quite fast for checking if one symbolic trace is trace-included in a determinate process, the number of symbolic traces of a process can be exponential and therefore an exponential number of such trace-inclusions need to be verified in order to check that two processes are trace-equivalent. We have used our tool to provide the first provably sound and automatic1 proof of vote privacy in the FOO e-voting protocol (Section 5.9.3). As future work, there are several tracks which deserve to be investigated:

1. Prove that the saturation procedure presented in the second part of the chapter terminates.

This would provide a very nice theoretical result that is also easy to implement in practice.

2. Get rid of the explicit enumeration of symbolic traces. The definition of a process as a set of all its symbolic traces is fine from a theoretical point of view, as long as complexity does not enter the picture. However, from a practical point of view, the unavoidable exponential blowup is very bad for the running time and the explicit enumeration of symbolic traces is very error-prone.

3. Get rid of the hypothesis of determinate processes. E-voting protocols, which represent the most important application for checking equivalence properties, are naturally not determinate. This means that approximations must be used in order to prove equivalences, such as the approximation that we used when verifying the FOO e-voting protocol.

4. Get rid of the "no else branch" hypothesis. In our current work, we only allow processes that perform tests and, if the test succeeds, they continue; otherwise they block. In practice, there are protocols which may do arbitrary actions in the "otherwise" branch. Verifying such protocols is a worthwhile goal.

5. Perform sound abstractions. Instead of having fully-abstract models of traces, construct sound models that allow proving equivalence properties. Not having to be fully-abstract may allow for better efficiency and could allow a tool to make security proofs for an unbounded number of sessions.

6. Work modulo AC or other equational theories. There are a number of cryptographic primitives such as Diffie-Hellman or XOR which cannot be oriented as a convergent term rewriting system. Working modulo AC (associative-commutative) operators could allow a tool to prove security properties under such cryptographic primitives.

Introduction

Most of existing techniques for proving protocols secure are dedicated to the analysis of a protocol, without taking into account other protocols which may be used at the same time. However, most cryptographic protocols do not run in isolation. Instead, several protocols can run on the same network and there might be undesirable interactions between protocols which cause security problems.

Even apparently isolated protocols might interact in unexpected ways. For example, a user might choose the same password for two different network services, or a server might use the same key for different protocols. Even if the network services (or the different protocols) were proven secure in isolation, there is no security guarantee which carries over when they share keys or passwords.

Furthermore, a number of protocols are verified under the assumption that agents share some pre-distributed keys (e.g. public keys or symmetric keys between agents and servers). But these keys might have been established by some other sub-protocols. There is no guarantee that a protocol remains secure if a specific key-exchange protocol is used to establish the keys, even if both protocols have been proven secure in isolation.

Even assuming that we could produce a global model of all protocols which are used in a certain setting, it might be unrealistic to formally verify such a collection of protocols in its entirety due to computational constraints.

Therefore more modular reasoning about security is desirable, where we can infer security guarantees for the composition of protocols from the security guarantees of the individual protocols. The goal of this chapter is to study the composition of protocols. Which security properties should P 1 and P 2 have such that running P 1 and P 2 on the same network (with possible information being passed between P 1 and P 2 ) is secure. In particular, given a protocol P 1 that has been proven secure assuming pre-established keys or assuming some secure channel, under which conditions does P 1 remain secure if it uses P 2 as a sub-protocol to establish some of keys?

Related Work

One of the first papers studying the composition of protocols in the Dolev-Yao model is [START_REF] Guttman | Protocol independence through disjoint encryption[END_REF]. In the formalism of strand spaces [START_REF] Fábrega | Strand spaces: proving security protocols correct[END_REF], Guttman and Thayer show that two protocols which make use of concatenation and encryption can be safely executed together without damaging interactions, as soon as the protocols are "independent". Also, an assumption is made that all keys are atomic and not generated for example by hashing some message. The independence hypothesis requires in particular that the sets of encrypted messages handled by the two protocols be disjoint. This is a semantic hypothesis on all possible executions of the two protocols which needs to be checked by hand.

In [START_REF] Cortier | Safely composing security protocols[END_REF], Cortier et al show that tagging is sufficient to avoid collusion between protocols sharing common keys and making use of standard cryptographic primitives: concatenation, signature, hash functions and encryption. This framework allows to compose processes symmetrically; however, it does not allow to securely compose e.g. a key exchange protocol with another protocol which makes use of the shared key. In particular, this is because the shared keys should never appear as payloads.

In [START_REF] Guttman | Cryptographic protocol composition via the authentication tests[END_REF], Guttman provides a non-trivial characterization which ensures that two protocols can run securely together when sharing some data such as keys or payloads. The main improvement over [START_REF] Guttman | Protocol independence through disjoint encryption[END_REF] is that keys are allowed to be non-atomic. The characterization is syntactic but has to be computed for each pair of protocols. As cryptographic primitives, the protocols are allowed to contain encryptions and concatenations. The proof method in our result is roughly similar to the proof methods described here: an attack against the composition is transformed into an attack against one of the two protocols.

In [START_REF] Delaune | Composition of password-based protocols[END_REF], Delaune et al use a derivative of the applied-π calculus to model off-line guessing attacks. They show that in the passive case resistance against guessing attacks is preserved by the composition of two protocols which share the weak secret against which the attack is mounted. This result (in the passive case) holds for arbitrary equational theories. However, for the active case this is no longer the case: it is however proven that tagging the weak secret enforces secure composition (in the sense of guessing attacks). Again, this framework applies to parallel composition only.

Mödersheim and Viganò [START_REF] Mödersheim | Secure pseudonymous channels[END_REF] have proposed a framework for composing protocols sequentially. They propose a criterion for a protocol P 1 to safely use P 2 as a sub-protocol (for implementing a secure channel). However, their criterion is a semantic criterion, for which no decision procedure has been provided yet. In [START_REF] Groß | Vertical protocol composition[END_REF], Groß and Mödersheim introduce vertical protocol compositions, where a key-exchange protocol is coupled with a protocol (called application protocol) which uses the exchanged key. Vertical compositions are similar to the sequential compositions we have used in this work. They identify a number of preconditions which, if satisfied by a set P of key-exchange protocols and application protocols, allow arbitrary vertical compositions among the protocol in P. Their work also allows for self-composition, in the sense that an application protocol can serve as a key-exchange protocol for yet another application protocol.

In [START_REF] Delaune | Simulation based security in the applied pi calculus[END_REF], Delaune et al use a simulation based approach inspired by work in the computational model [START_REF] Canetti | Universally composable security: A new paradigm for cryptographic protocols[END_REF] to provide a framework for securely composing protocols in the applied-π calculus. This involves defining for each sub-protocol an ideal functionality and then showing that a certain implementation securely emulates the ideal functionality. Another line of work is represented by the Protocol Composition Logic [START_REF] Datta | Protocol composition logic (PCL)[END_REF], which can be used to modularly prove security properties of protocols using a fixed set of primitives. However, the proofs may be rather involved and are not automatic.

Contribution

In this chapter, we propose a generic composition result for arbitrary cryptographic primitives which can be modeled by equational theories. More precisely, we show that an attack trace against the composition of two protocols can be transformed into an attack trace against one of the two protocols.

The composition theorem holds for any cryptographic primitives which can be modeled by equational theories, provided that the signatures of the two composed protocols are disjoint. This allows us to handle many cryptographic primitives: symmetric and asymmetric encryption, hash functions, messages authentication codes, signatures, blind signatures, re-encryption, zeroknowledge proofs and others [START_REF] Backes | Zero-knowledge in the applied pi-calculus and automated verification of the direct anonymous attestation protocol[END_REF][START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. We can also allow some common primitives between the two protocols, such as encryption and hash, provided that they are tagged. In order to formally describe and reason about protocols and their compositions, we introduce in Section 6.2 a slightly different process algebra than in the previous chapter. This (new) process algebra contains actions such as νn and | and is more adapted to describing compositions of protocols than the one used in the previous chapter. We concentrate on proving secrecy properties of compositions although we believe that our result carries over to other trace properties such as authentication.

Our main theorem is generic in the sense that the composition can be any interleaving of actions from the two protocols: for example, the composition can be parallel or sequential, possibly with nested replication. In particular, we capture the case where a protocol uses a sub-protocol to e.g. establish keys. As a consequence, we can for example easily compose a protocol using Diffie-Hellman exponentiation for establishing symmetric keys, together with any protocol making use of pre-established keys.

Applications. Our main composition result can be used in different contexts. As an application, we study the case of key-exchange protocols. We first consider the case where a key-exchange protocol is used to establish shared long-term keys.

Assume that P = νn.(P 1 | P 2 ) is a protocol that establishes a key between two participants. The process P denotes the parallel execution of a participant modeled by P 1 and another participant modeled by P 2 . The two agents P 1 and P 2 share the previously distributed key n. The goal of the protocol P is to establish a fresh shared session key between P 1 and P 2 . Assume that the key will be stored in the variable y 1 for P 1 and the variable y 2 for P 2 .

We identify which properties should be satisfied by P in order to be safely used within any other protocol. As expected, we retrieve the fact that the established key (stored in y 1 for P 1 and in y 2 for P 2 ) should remain secret to an attacker, but we also point out two other important properties which are not always checked when verifying key-exchange protocols.

We show that whenever P satisfies our identified properties and if a protocol Q is secure assuming pre-established keys (e.g. if Q preserves the secrecy of some data s):

Q = νk.((y 1 := k).Q 1 | (y 2 := k).Q 2 ) |= Secret(s)
then Q remains secure when running P as subprotocol for establishing the secret key (in y 1 for the first participant and in y 2 for the second participant):

νn • (P 1 • Q 1 | P 2 • Q 2 ) |= Secret(s).
We also consider the case where a key-exchange protocol is used within each session for establishing a secure channel. We show that if a protocol Q ′ is secure assuming a secure channel:

Q ′ =!(νk.((y 1 := k).Q 1 | (y 2 := k).Q 2 )) |= Secret(s)
then Q ′ remains secure when running P as subprotocol:

!(νn.(P 1 .Q 1 | P 2 .Q 2 )) |= Secret(s).
Our approach has several advantages over prior work. As opposed to [START_REF] Guttman | Protocol independence through disjoint encryption[END_REF][START_REF] Cortier | Safely composing security protocols[END_REF][START_REF] Guttman | Cryptographic protocol composition via the authentication tests[END_REF][START_REF] Mödersheim | Secure pseudonymous channels[END_REF][START_REF] Groß | Vertical protocol composition[END_REF], our result allows not only the standard cryptographic primitives like encryption and hash functions, but arbitrary primitives expressible as equational theories. Furthermore, unlike [START_REF] Cortier | Safely composing security protocols[END_REF][START_REF] Delaune | Composition of password-based protocols[END_REF], our result allows to compose protocols asymmetrically (i.e. not just in parallel). A difference between our approach and [START_REF] Delaune | Simulation based security in the applied pi calculus[END_REF] is that we do not need to prove anything about the protocols we are trying to compose except standard reachability properties. In particular, we do not have to provide a key exchange functionality and prove that an implementation satisfies this functionality. However, [START_REF] Delaune | Simulation based security in the applied pi calculus[END_REF] can be used to reason about protocols which do share primitives.

This chapter is based on work [START_REF] Ciobâcȃ | Protocol composition for arbitrary primitives[END_REF] that has been published at CSF 2010.

Plan of the Chapter. In Section 6.2 we introduce a process algebra which is suitable for defining composition of protocols. In Section 6.3 we identify difficulties in composing protocols and we give examples of compositions that "go wrong". Once we rule out the problematic cases that we identified, we propose a generic composition theorem for protocols employing disjoint cryptographic primitives in Section 6.4. We present applications of this theorem to key establishment protocols in Section 6.5. We show that a form of tagging is sufficient to enforce disjointness of cryptographic protocols making use of symmetric encryption and hash functions in Section 6.6. We conclude our work in Section 6.7 with perspectives for further work.

Process Algebra

We now introduce the process algebra that we use to describe protocols and their composition.

As opposed to the process algebra that we have used in the previous chapter, this process algebra is tailored to easily describe protocol compositions and reason about their security. The process algebra closest to ours is the applied π-calculus [3]. However, the applied π-calculus is not adequate in our case since it makes formulating our main theorem unnecessarily cumbersome. The main differences between our calculus and the applied π-calculus are the following ones:

• we add a synchronization phase, so that we can write P.Q for arbitrary processes P and Q. This is important to express the fact that a protocol first runs P before continuing with Q,

• we consider only one public channel,

• only positive tests are allowed (no else branches).

Processes are defined inductively in Figure 6.1. The null process (or the empty process) 0 does nothing. The process νx binds x to a fresh private name. The process receive(x) reads a term t from the public channel, and binds x to t. The assignment process (x := t) instantiates x with t. The process send(t) outputs the term t on the public channel. The test process [s = t] blocks if s = E t and does nothing otherwise. The sequential composition process P.Q executes P followed by Q. The parallel composition process (P | Q) runs P and Q in parallel. The replication process !P will act as an infinite number of P s in parallel. We may write ν{x 1 , . . . , x k } instead of νx 1 . . . . .νx k .

P, Q . . . ::= processes | 0 (null process) | νx for x ∈ X (fresh name) | receive(x) for x ∈ X (input) | (x := t) for x ∈ X , x ∈ Var (t), t ∈ T (F, X ) (assignment) | send(t) for t ∈ T (F, M ∪ X ) (output) | [s = t] for s, t ∈ T (F, M ∪ X ) (test) | (P.Q) (sequential composition) | (P | Q) (parallel composition) | !P (replication)
When we write processes, we assume that "!" binds strongest, followed by "|" and then by ".". We assume that the variables introduced by νx, receive(x) and (x := t) are bound throughout sequential composition (denoted by ".") as far to the right as possible. By fv (P ) we denote the set of free variables of P . We identify processes up to α-renaming of bound variables and up to the following structural equivalence rules in Figure 6.2.

P ≡ P.0 ≡ 0.P P | 0 ≡ P (P | Q) | R ≡ P | (Q | R) !0 ≡ 0 P | Q ≡ Q | P !P ≡ P |!P
E DH = {f (g(y), x) = f (g(x), y)}
the function symbols f and g model the Diffie-Hellman primitives (f (x, y) = x y mod p, g(y) = α y mod p for a generator α) and mac denotes a keyed hash function.

We have that the process P DH = νx k .(P 1 | P 2 ) models for the Diffie-Hellman protocol if P 1 = νx.send(g(x)).send(mac(g(x), x k )).receive(z).receive(z ′ ).

[z ′ = mac(z, x k )].y 1 := f (x, z) and P 2 = νy.send(g(y)).send(mac(g(y), x k )).receive(z).receive(z ′ ).

[z ′ = mac(z, x k )].y 2 := f (y, z).

The process P 1 models the first participant in an authenticated Diffie-Hellman key exchange while P 2 models the second participant. The free variable x k should be previously shared by the two participants to ensure authentication.

Processes are executed within an environment formed of a frame ϕ that contains messages sent over the network (as in the applied π-calculus) and a binding substitution σ whose domain is a subset of the free variables of the process. The formal operational semantics is given by the transition relations -→ F ,E and t -→ F ,E (where t is a label receive(r)) described in Figure 6.3.

New P = νx.R x ∈ Dom(σ) n ∈ N fresh (P, ϕ, σ) - → F ,E (R, ϕ, σ ∪ {x → n}) Input P = receive(x).R ϕ ⊢ r F ,E t x ∈ Dom(σ) (P, ϕ , σ) receive(r)
-------→ F ,E (R, ϕ, σ ∪ {x → t})

Assgn P = (x := t).R x ∈ Dom(σ) Var (t) ⊆ Dom(σ) tσ = E t ′ (P, ϕ, σ) - → F ,E (R, ϕ, σ ∪ {x → t ′ }) Output P = send(t).R Var (t) ⊆ Dom(σ) t ′ = E tσ (P, ϕ, σ) - → F ,E (R, ϕ ∪ {w |Dom(ϕ)|+1 → t ′ }, σ) Test P = [s = t].R sσ = E tσ Var (s), Var (t) ⊆ Dom(σ) (P, ϕ, σ) - → F ,E (R, ϕ, σ) Parallel P = (Q 0 | Q 1 ).R (Q 0 , ϕ, σ) § -→ F ,E (Q ′ 0 , ϕ ′ , σ ′ ) (P, ϕ, σ) § -→ F ,E ((Q ′ 0 | Q 1 ).R, ϕ ′ , σ ′ ) Figure 6.3: Operational Semantics.
The New operation chooses a fresh name n, binds x to n and moves to the next action. The Input operation waits for a term t constructible by the recipe r from the frame ϕ containing the messages already exchanged on the network, binds x to t and moves to the next action. The Assign operation binds x to tσ and continues to the next action. The Output operation adds to the frame the term tσ being output. The Test operation moves to the next operation if the two terms being compared are equal and blocks otherwise. The Parallel operation states that a parallel composition can proceed as either of the two processes being run in parallel.

In Figure 6.3, § is a meta-variable denoting either the empty string, in which case

§ -→ F ,E =-→ F ,E , or a label x = receive(r), in which case § -→ F ,E = receive(r) -------→ F ,E . The relation l1•...•ln ----→ * F ,E is defined as - → * F ,E l1 -→ F ,E - → * F ,E l2 -→ F ,E - → * F ,E . . . - → * F ,E ln -→ F ,E - → * F ,E
. We omit F and E when they are clear from the context.

Examples of process executions can be found in Section 6.3. We conclude this section by defining secrecy and freshness. Secrecy and freshness are two properties that we require of protocols in order to compose them securely. Intuitively, a variable is secret if in any protocol execution, its instantiation remains not deducible. We will require variables that are shared between two protocols to be kept secret by both protocols in order to securely compose them. Otherwise, if a protocol reveals a shared variable, it might create a dangerous situation for the other protocol as exemplified in Section 6.3.1. Definition 6.1 (secrecy). We say that a process P preserves the secrecy of x ∈ Var (P ) in the equational theory E, and we denote it by P |= E Secret(x), if whenever (P, ∅, ∅) l1,...,ln

→ * (Q, ϕ, σ) we have that ϕ ⊢ E xσ.
Freshness of a variable with respect to a set of variables is another security property that we will demand of the two protocols in order to secure compose them. Intuitively, freshness of a variable means that protocols do not reuse one of the older secrets to instantiate this variable. The reuse by a protocol of some older secret in shared variable might create an equality unexpected by the second protocol and might lead to an insecure situation as exemplified in Section 6.3.3. Definition 6.2 (freshness). We say that a process P guarantees the freshness of x ∈ Var (P ) w.r.t. {y 1 , . . . , y k } ⊆ Var (P ) in the equational theory E if whenever

(P, ∅, ∅) l1,...,ln ----→ (Q, ϕ, σ)
we have that xσ = E y i σ for all 1 ≤ i ≤ k.

In the above definitions we assume that the variables in the processes have been conveniently α-renamed before application of the definition. If the above definitions concern variables appearing under replications, we assume that the conditions hold for any of the variables denoted by x (and resp. y 1 , . . . , y k ). This can be achieved formally by coloring all bound variables with different colors; whenever a variable is α-renamed it preserves its color. We would then say that a certain color c is secret when all variables colored with c remain secret. As this technicality is not essential in our approach, we prefer to use the less formal version.

Difficulties

Of course, two protocols P, Q cannot in general be (securely) composed in arbitrary ways. We illustrate several cases where composing two secure protocols yields an attack. For readability, in this section we use the notation {s} t for the term enc(s, t).

Revealing Shared Keys

If a protocol P is establishing a (secret) key k, then a protocol Q using the key k should not reveal it. This would clearly compromise the security of P but it could also compromise the security of Q. Assume for example that a protocol P 1 (playing the role of P above) generates two fresh (secret) data x and y and reveals the encryption of x under y: P 1 = νx.νy.send({x} y ) Note that P 1 may compute x and y in a more complicated way, but we consider just the rather trivial case where x and y are instantiated to fresh nonces for the sake of clarity. Then P 1 preserves the secrecy of both x and y. Assume now that a process Q 1 (playing the role of Q above) reveals y and uses x for encrypting a secret z: Q 1 = νz.send(y).send({z} x ).

Then νx ′ .νy ′ .(x := x ′ ).(y := y ′ ).Q 1 preserves the secrecy of z, while the composition P 1 .Q 1 of both processes does not preserve the secrecy of z. Indeed

(P 1 .Q 1 , ∅, ∅) - → * (0, ϕ, σ = {x → k 1 , y → k 2 , z → k 3 }) for fresh private names k 1 , k 2 , k 3 ∈ N , where ϕ = {w 1 → {k 1 } k2 , w 2 → k 2 , w 3 → {k 3 } k1 }.
We have ϕ ⊢ dec(w3,dec(w1,w2)) Eenc zσ and thus P 1 .Q 1 |= Eenc Secret(z), where E enc = {dec(enc(x, y), y) = x} models symmetric encryption.

Note that this attack works even if P 1 and Q 1 actually use different encryption symbols (thus even if they use disjoint signatures).

Sharing Primitives

The interaction of two protocols using common primitives may yield an attack, even if each of the protocols is secure when executed in isolation. Indeed, consider again the process P 1 described above and let Q 2 be a process that uses x for encrypting a secret z and outputs m for any m received under the encryption of y. Q 2 = νz.send({z} x ).receive(z ′ ).send(dec(z ′ , y)).

Then νx ′ .νy ′ .(x := x ′ ).(y := y ′ ).Q 2 preserves the secrecy of z, while the composition P 1 .Q 2 of both processes does not preserve the secrecy of z. Indeed

(P 1 .Q 2 , ∅, ∅) receive(w1) --------→ * (0, ϕ ′ , σ ∪ {z ′ → {k 1 } k2 })
where σ has been defined above and ϕ

′ = {w 1 → {k 1 } k2 , w 2 → {k 3 } k1 , w 3 → k 1 }. We have ϕ ′ ⊢ dec(w2,w3) Eenc zσ, thus P 1 .Q 2 |= Eenc Secret(z).
So, in what follows, we will assume that the composed protocols use disjoint primitives. In Section 6.6, we extend our result to the case where the protocols may share some primitives such as encryption and hash, provided they are tagged.

Key Freshness

It is important that shared variables (that are assumed to be fresh) are indeed instantiated by fresh values. Assume for example that a protocol R = R 1 .R 2 .R 3 is composed of three phases:

• it first generates a fresh key x: let R 1 = νx;

• it then runs a sub-protocol R 2 to establish some secret y;

• it outputs a fresh value z if x = y: let R 3 = νz.[x = y].send(z).
Then R preserves the secrecy of z when R 2 = νk.(y := k) chooses y to be a fresh key: R 1 .νk.(y := k).R 3 |= Secret(z) while it is not secure for all sub-protocols R 2 establishing a secret key y. Indeed, for R ′ 2 = (y := x), we have that νk.(x := k).R ′ 2 preserves the secrecy of the shared key y but, because y is not fresh,

R 1 .R ′ 2 .R 3 |= Secret(z).
In what follows, we will see that the three situations that we have described in Section 6.3.1, Section 6.3.2 and respectively Section 6.3.3 are actually the only problematic cases and we will therefore require in our composition theorem that sub-protocols do not introduce such equalities.

Composing Disjoint Protocols

In our composition theorem, we show that under appropriate conditions, protocols that use disjoint cryptographic primitives compose well. We formalize the fact that two protocols use disjoint cryptographic primitives by ensuring that the protocols run over two distinct signatures, each equipped with its own equational theory.

Combination of Equational Theories

We will therefore consider that the signature F consists of the union of two disjoint signatures F a and F b , i.e. F = F a ∪ F b where F a ∩ F b = ∅. We also consider an equational theory E a over F a and an equational theory E b over F b . We define the equational theory E = E a ∪ E b (over F) to be the union of the equational theories E a and E b . Note that the relation = E (as defined in Chapter 2) is not in general the union of = Ea and = E b . We will assume w.l.o.g. that the two equational theories E a and E b are not trivial: Definition 6.3. An equational theory E 0 is trivial if s = E0 t for any terms s, t.

Trivial equational theories are not very interesting since any two terms are rendered equal by the theory. If one of E a or E b is trivial, then so is E = E a ∪ E b . Under a trivial equational theory, the intruder trivially knows all terms and implicitly all "secrets".

We also consider N a ⊎ N b ⊎ N c = N to be a partition of the set of private names and M a ⊎ M b ⊎ M c = M to be a partition of the set of public names. We let

D a = F a ∪ N a ∪ M a be the a-domain, D b = F b ∪ N b ∪ M b be the b-domain and D c = M c ∪ N c ∪ W ∪ X be the c-domain.
Note that while the a-domain D a and the b-domain D b contain function symbols, the c-domain D c does not. However, the c domain D c contains all parameters w i ∈ W, while D a and D b do not contain any parameter. For symmetry with the other two domains, we define F c to be the empty signature and E c = {} to be the empty equational theory.

For every d ∈ {a, b, c}, we define the set of pure d-terms to be T (F d , D d \ F d ∪ X ). A term is pure if it is a pure d-term for some d ∈ {a, b, c}. We say that a process is over the d-domain (with d ∈ {a, b}) if all terms appearing in the process are pure d-terms.

Composition Theorem

Since a run of the protocol involves only a finite number of replications and determines the scheduling in parallel composition, we simply need to state our main result on traces, that is processes that contain neither parallel composition nor replication. In order to state our composition theorem in a general way, we simply need to show that any execution trace on two combined processes can be transformed into an execution trace on one of the two processes. Then a trace of the composition leading to an attack can be transformed into a trace of one of the individual protocols leading to an attack. The fact of stating the main composition theorem on traces is not a limitation, since our theorem can be used to securely compose processes with arbitrary replications and parallel compositions, as illustrated in Section 6.5.

We say that a process is atomic if it is one of send(t), receive(x), [s = t], x := t, νx for some terms s, t and some variable x.

Let P = P 1 . . . . .P n be a trace over the a-domain with free variables {x 1 , . . . , x p } where P i is an atomic process (1 ≤ i ≤ n). Let Q = Q 1 . . . . .Q m be a trace over the b-domain with free variables {y 1 , . . . , y q } where Q i is an atomic process (1 ≤ i ≤ n). Intuitively, the free variables of Q are established by P and conversely, the free variables of P are established by Q.

Let R = R 1 . . . . .R n+m be a ground interleaving of P 1 , . . . , P n , Q 1 , . . . , Q m , that is fv (R) = ∅ and {R 1 , . . . , R n+m } = {P 1 , . . . , P n , Q 1 , . . . , Q m } (as multi-set equality). We consider R ′ to be a copy of R where the shared variables of P and Q are duplicated. More precisely, let R ′ = R ′ 1 . . . . .R ′ n+m be such that 1. R ′ i = P j {x → x a } if R i is P j for some j and where x ranges over all variables in P j Theorem 6.1. Assume ϕ 0 ⊢ tσ for any t ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } and that x i σ 0 = E y j σ 0 for all 1 ≤ i ≤ p ′ , 1 ≤ j ≤ q ′ . Then there exist S ′ , ϕ ′ , σ ′ such that

(R ′′ , ∅, ∅) l1,...,l k , § -----→ * (S ′ , ϕ ′ , σ ′ ) (6.2)
and 1. if r is a minimal recipe such that ϕ ⊢ r xσ 0 for some x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ }, then

ϕ ′ ⊢ r x d σ ′ 0 for some d ∈ {a, b}. 2. otherwise, if ϕ ⊢ r xσ for x ∈ Var (P ) ∪ Var (Q) \ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } then ϕ ′ ⊢ r x d σ ′
for some d ∈ {a, b}.

Furthermore, if x, y ∈ Dom(σ) are such that xσ = E yσ and x d , y d ∈ Dom(σ ′ ) for some d ∈ {a, b}, then

x d σ ′ = E y d σ ′ .
Intuitively, R ′′ is a composition of P and Q where the two processes do not share variables anymore. Theorem 6.1 says that we can mimic on R ′′ the execution trace of R. Furthermore, if R reveals a shared variable, R ′′ reveals some (duplicated) shared variable as well. It will be used in the next section to conclude that one of the two processes P or Q (executed alone) reveals one of its (shared) variables thus is not secure. Indeed, assume w.l.o.g. that R ′′ reveals the variable x a i . Since R ′′ corresponds to P executed in parallel (and independently) of Q, the process Q can be entirely simulated by the adversary; thus P reveals x i , that is P |= E Secret(x i ). By Theorem 6.1, we obtain that there exist a process S ′ , a frame ϕ ′ and a substitution σ ′ such that (R ′′ , ∅, ∅) → 5 (S ′ , ϕ ′ , σ ′ ).

Let r = w 2 be a minimal for yσ 0 in the frame ϕ. By Item 1, we have that w 2 is recipe in ϕ ′ of y b σ ′ .

The final remark in Theorem 6.1 (that xσ = E yσ implies x d σ ′ = E y d σ ′ ) is important to be able to completely separate the processes P and Q in R ′′ : as the variable

x a i (1 ≤ i ≤ p ′ ) and y b i (1 ≤ i ≤ q ′ )
are instantiated in the process R ′′ by fresh names such that x a i and y b j receive the same name if x i σ = E y j σ, it is important that such an equality does not happen. Otherwise, the two processes still share data and therefore we cannot conclude about either of them individually.

Proof of Theorem 6.1

This subsection consists of the proof of Theorem 6.1, which requires several non-trivial steps:

1. we define (Definition 6.5) a canonical form for each term that is called the collapsed form and which is obtained by replacing each term with an alien subterm to which it is equal, if such an alien subterm exists. An alien subterm is a subterm whose root symbol comes from a different signature than the root symbol of the term itself.

The collapsed form of a term enjoys the property that each subterm has a canonical domain by avoiding spurious patterns such as h -1 (h(•)) as shown in Example 6.5. Furthermore, in two collapsed terms which are equal modulo = E , alien subterms can be abstracted by names and the equality modulo = E still holds (Lemma 6.6).

2. having terms in collapsed form, we can intuitively decide depending on the signature of the root symbol which of the two protocols created the term (even if subterms were created by the other protocol). Whenever a signature change occurs in a term, it means that either the subterm where the signature change occurs is the instantiation of one of the variables shared by the two protocols or that it was transmitted by the intruder to the protocol.

Since our goal is to show that from the run of the composition, we can produce a run where the shared variables are duplicated and the free variables instantiated by fresh names, we define (Definition 6.4) a function R ñ d,s which replaces the occurrences of the instantiations s of the shared variables by the fresh names ñ for the shared variables instantiated by the protocol from signature d ∈ {a, b}.

3. using the previously defined function R ñ d,s , we transform the collapsed run of the interleaving of the two traces into a run on the same interleaving, but where all shared variables are duplicated and where free variables are instantiated with fresh names.

Using the properties of col and of R ñ d,s proved in Lemma 6.7, Lemma 6.8, Lemma 6.9 and Lemma 6.10, we can prove that the new run succeeds (i.e. it obeys the operational semantics) and that if the initial run ended with an attack, the newly defined run has a similar attack.

Disjoint Equational Theories

Note that we have assumed that the two equational theories E a and E b are not trivial. Non-trivial equational theories enjoy the following property: Proof. By contradiction, we assume a = b but a = E0 b. We consider two arbitrary terms s and t and the replacement σ = {a → s, b → t}. As E 0 is stable by replacement of atoms by terms, we have that s = aσ = E0 bσ = t. Therefore s = E0 t for arbitrary terms s and t. Therefore E 0 is trivial, which contradicts the hypothesis. Therefore our assumption was false and we have a = E0 b.

If t is a term, we let root(t) denote the topmost symbol of the term:

root(t) = f if t = f (t 1 , . . . , t n ) a if t = a ∈ A
If t is a term, we define the domain of t to be the domain of its topmost symbol:

domain(t) = d ∈ {a, b, c} iff root(t) ∈ D d . If d ∈ {a, b}, then a context C ∈ T (F d , D d ∪ { 1 , . . . , k }) is called a pure d-context. If C = 1 is

Replacing Terms

In the proof of the theorem, we will be "abstracting away" the keys generated by a protocol and we will replace them with fresh names. This replacement is captured by the function R ñ d,s , defined below.

Let e ∈ {a, b} be a domain, let s = s 1 , . . . , s k be terms, let ñ = n a 1 , . The function R ñ e,s is designed to replace the terms s 1 , . . . , s k occurring at places where the signature changes from F a to F b (or vice-versa). The term s i will be replaced by either n a i or by n b i , depending on what signature appears directly above s i . The argument e is used to "initialize" the signature, i.e. define what signature is "above" the entire term.

We extend R ñ e,s to frames as expected:

R ñ e,s ({w

1 → t 1 , . . . , w n → t n }) = {w 1 → R ñ e,s (t 1 ), . . . , w n → R ñ e,s (t n )}.

Collapsed Form

Since we do not make any assumption on E a and E b , there is no normal form. Following Chapter 9 of [START_REF] Baader | Term rewriting and all that[END_REF], we define a canonical form col(t) of a term t modulo E, called the collapsed form of t.

The idea of the collapsed form is to assign a canonical domain to the topmost symbol of a term. As shown in the following example, rewriting modulo E might change the signature of the topmost symbol, as the following examples shows:

Example 6.5. Let E a = {h -1 (h(x)) = x} and E b = {dec(enc(x, y), y) = x}. We have that h -1 (h(enc(s, k))) = E enc(s, k). The topmost symbol h -1 ∈ F a changed to enc ∈ F b during the rewrite step.
The idea of the collapsed form is to simplify the term by removing spurious parts such as h -1 (h(•)).

Formally, to obtain the collapsed form of a term, the term is (recursively) replaced with any of its alien subterms to which it is equal modulo E as follows, Definition 6.5.

col(t) =                    t if t ∈ A is an atom s i if t = f (t 1 , . . . , t l ), f (col(t 1 ), . . . , col(t l )) = C[[s 1 , . . . , s k ]] and C[[n 1 , . . . , n k ]] = E d n i
where n 1 , . . . , n k are fresh names such that n i = n j iff s i = E s j for all 1 ≤ i, j ≤ l and d = domain(C) f (col(t 1 ), . . . , col(t l )) if t = f (t 1 , . . . , t l ) but the above condition does not hold.

We can prove that the collapsed form of a term is equal modulo the equational theory to the term itself: Lemma 6.2. For any term t, we have that col(t) = E t.

Proof. By induction on the size of t.

1. For the base case, if t is an atom, then col(t) = t by the definition of col and therefore col(t) = E t. We can therefore apply the induction hypothesis on every pair t

i , t j 1 ≤ i, j ≤ k + l to obtain that if t i = E t j then R ñ c,s (col(t i )) = E R ñ c,s (col(t j )). Furthermore, by Lemma 6.4, we have that col(t i ) = t i for all 1 ≤ i ≤ k + l. Therefore t i = E t j implies R ñ c,s (t i ) = E R ñ c,s (t j ) for all 1 ≤ i, j ≤ k + l. Let [i] denote the smallest index j such that R ñ c,s (t i ) and R ñ c,s (t j ) are equal modulo E: [i] = min{j | R ñ c,s (t j ) = E R ñ c,s (t j )}. As C[[n 1 , . . . , n k ]] = Ec D[[n k+1 , . . . , n k+l ]], we have by enlarging the equational theory that C[[n 1 , . . . , n k ]] = E D[[n k+1 , . . . , n k+l ]]
and, as E is stable by replacement of names with arbitrary terms, we obtain

C[[n 1 , . . . , n k ]]σ = E D[[n k+1 , . . . , n k+l ]]σ where σ = {n i → R ñ c,s (t [i] )} 1≤i≤k+l . As R ñ c,s (t i ) = E R ñ c,s (t [i]
) by the definition of [i] for all 1 ≤ i ≤ k + l, we have that

C[[R ñ c,s (t 1 ), . . . , R ñ c,s (t k )]] = E D[[R ñ c,s (t k+1 ), . . . , R ñ c,s (t k+l )]] as well. Equivalently, R ñ d,s (col(s)) = E R ñ d,s (col(t)),
which is what we had to prove.

We also need the following easy technical result. Lemma 6.8. Let t be a term such that t = E s i for any s i ∈ s. Then R ñ a,s (t) = R ñ b,s (t).

Proof. We distinguish among the three cases of the definition of R ñ c,s (with c ∈ {a, b}). As t = E s i for any s i ∈ s, we cannot be in the first cases.

If

t = f (t 1 , . . . , t l ), we have that R ñ a,s (t) = f (R ñ d,s (t 1 ), . . . , R ñ d,s (t l )) = R ñ b,s (t) where d ∈ {a, b} is such that f ∈ F d . Otherwise, R ñ a,s (t) = t = R ñ b,s (t).
Lemma 6.9. Let s = s 1 , . . . , s n be terms, let ϕ be a frame and let r be a recipe over ϕ such that ϕ ⊢ r ′ E s i for any 1 ≤ i ≤ n and for any subrecipe r ′ ⊑ r of r. Then for any c ∈ {a, b} we have that

rR ñ c,s (col(ϕ)) = E R ñ c,s (col(rϕ)).
Proof. We make the proof by induction on the size of r.

1. if r = w i ∈ Dom(ϕ), we immediately have that

rR ñ c,s (col(ϕ)) = w i R ñ c,s (col(ϕ)) = R ñ c,s (col(w i ϕ)) = R ñ c,s (col(rϕ)).
2. otherwise, if r = a ∈ A is an atom other than a parameter w i ∈ Dom(ϕ), we have that a

∈ s (because ϕ ⊢ r a). Therefore R ñ c,s (col(a)) = R ñ c,s (a) = a. We have rR ñ c,s (col(ϕ)) = aR ñ c,s (col(ϕ)) = a = R ñ c,s (col(a)) = R ñ c,s (col(aϕ)) = R ñ c,s (col(rϕ)).
3. otherwise, r = f (r 1 , . . . , r k ) for some recipes r 1 , . . . , r k . By the definition of col, we have that:

(a) either col(rϕ) = f (col(r 1 ϕ), . . . , col(r k ϕ)), in which case by the definition of R ñ c,s and because rϕ = E s i for any 1 ≤ i ≤ n, we obtain

R ñ c,s (col(rϕ)) = f (R ñ d,s (col(r 1 ϕ)), . . . , R ñ d,s (col(r k ϕ)))
,

where d ∈ {a, b} is such that f ∈ D d .
By the induction hypothesis, we have that

r i R ñ d,s (col(ϕ)) = E R ñ d,s (col(r i ϕ)) for all 1 ≤ i ≤ l. Then R ñ c,s (col(rϕ)) = E f (r 1 R ñ d,s (col(ϕ)), . . . , r k R ñ d,s (col(ϕ))) = f (r 1 , . . . , r k )R ñ d,s (col(ϕ)), which is equal, by Lemma 6.8, to rR ñ c,s (col(ϕ)). (b) or f (col(r 1 ϕ), . . . , col(r k ϕ)) = C[[t 1 , . . . , t m ]], C[n 1 , . . . , n m ] = E d n x for some 1 ≤ x ≤ m
where n 1 , . . . , n m are fresh names such that

n i = n j iff t i = E t j (for all 1 ≤ i ≤ m) where d ∈ {a, b} is such that f ∈ F d , and col(rϕ) = t x . As C[n 1 , . . . , n m ] = E d n x and E d ⊆ E, we have that C[n 1 , . . . , n m ] = E n x .
Note that, as C is not the empty context, we have that for any 1 ≤ i ≤ m, t i is a subterm of some col(r j ϕ) (1 ≤ j ≤ k). Therefore, by Lemma 6.4, we have that col(t i ) = t i for all 1 ≤ i ≤ m.

We have that the right-hand side of the equality we are trying to prove is R ñ c,s (col(rϕ)) = R ñ c,s (t x ). The left-hand side (from hereon, lhs) of the equality is

r(R ñ c,s (col(ϕ))) = f (r 1 , . . . , r k )R ñ c,s (col(ϕ)) = f (r 1 R ñ d,s (col(ϕ)), . . . , r k R ñ d,s (col(ϕ)))
where d ∈ {a, b} is such that f ∈ F d . By the induction hypothesis,

r i R ñ d,s (col(ϕ)) = E R ñ d,s (col(r i ϕ)) for all 1 ≤ i ≤ l. Therefore the lhs is r(R ñ c,s (col(ϕ))) = E f (R ñ d,s (col(r 1 ϕ)), . . . , R ñ d,s (col(r k ϕ))), which, as f (col(r 1 ϕ), . . . , col(r k ϕ)) = E rϕ = E s i for any 1 ≤ i ≤ n, is equal by the definition of R ñ c,s , to R ñ c,s (f (col(r 1 ϕ), . . . , col(r k ϕ))). But by assumption f (col(r 1 ϕ), . . . , col(r k ϕ)) = C[[t 1 , . . . , t m ]]. As C starts with f ∈ F d , we obtain R ñ c,s (f (col(r 1 ϕ), . . . , col(r k ϕ))) = R ñ c,s (C[t 1 , . . . , t m ]) = C[R ñ d,s (t 1 ), . . . , R ñ d,s (t m )].
We have shown that the lhs of the equality is r

(R ñ c,s (col(ϕ)) = E C[R ñ d,s (t 1 ), . . . , R ñ d,s (t m )]. But C[n 1 , . . . , n m ] = E n x . As n i = n j implies t i = E t j (by choice of n i ) and t i = E t j implies R ñ d,s (col(t i )) = E R ñ d,s (col(t j )) by Lemma 6.7. But t i = col(t i ) for all 1 ≤ i ≤ m and therefore n i = n j implies R ñ d,s (t i ) = E R ñ d,s (t j )
for all 1 ≤ i, j ≤ m. Therefore, as C[n 1 , . . . , n m ] = E n x and as the equational theory E is stable by replacement of names by arbitrary terms, we obtain that C

[R ñ d,s (t 1 ), . . . , R ñ d,s (t m )] = E R ñ c,s (t x )
. Therefore the lhs of the equality is r(R ñ c,s (col(ϕ))) = E R ñ c,s (t x ). We have shown that the right-hand side of the equality is R ñ c,s (col(rϕ)) = R ñ c,s (t x ) and that the left-hand side of the equality is r(R ñ c,s (col(ϕ))) = E R ñ c,s (t x ). As both the rhs and the lhs are equal modulo E to the same term, we conclude by transitivity that r(R ñ c,s (col(ϕ))) = E R ñ c,s (col(rϕ)).

Lemma 6.10. Let c ∈ {a, b} be a domain, let ϕ be a frame, let s 1 , . . . , s k be ground terms and let r 1 , . . . , r l be recipes over ϕ such that ϕ ⊢

r ′ i E s i for any 1 ≤ i ≤ k and for any subrecipe r ′ i ⊑ r i of r i . Let σ = {x i → s i } 1≤i≤k and let τ = {y i → r i ϕ} 1≤i≤l . If s is a pure c-term, then R ñ c,s (col(sστ )) = E sσ ′ τ ′ , where σ ′ = {x i → R ñ c,s (col(s i ))} 1≤i≤k and τ ′ = {y i → R ñ c,s (col(r i ϕ))} 1≤i≤l . Proof.
By induction on the size of s:

1. if s = x i ∈ Dom(σ), then sστ = s i and R ñ c,s (col(sστ )) = R ñ c,s (col(s i )). Similarly, sσ ′ τ ′ = σ ′ (x i ) = R ñ c,s (col(s i )) and therefore R ñ c,s (col(sστ )) = sσ ′ τ ′ . 2. if s = y i ∈ Dom(τ ), then sστ = r i ϕ and R ñ c,s (col(sστ )) = R ñ c,s (col(r i ϕ)). But sσ ′ τ ′ = y i σ ′ τ ′ = y i τ ′ = r i R ñ c,s (col(ϕ)). By Lemma 6.9, r i R ñ c,s (col(ϕ)) = E R ñ c,s (col(r i ϕ)). Therefore sσ ′ τ ′ = E R ñ c,s (col(r i ϕ)). Therefore R ñ c,s (col(sστ )) = E sσ ′ τ ′ . 3. if s = a ∈ A \ (Dom(σ) ∪ Dom(τ )
) is an atom not in the domains of σ and τ , we have that sστ = a and sσ ′ τ ′ = a.

By the definition of col, we have that col(sστ ) = col(a) = a. As s is a pure c-term, we have that a ∈ D c and therefore 4. otherwise s = f (t 1 , . . . , t n ) for some pure c-terms t 1 , . . . , t n and we distinguish between two cases:

R ñ c,s (a) = a. Therefore R ñ c,s (col(sστ )) = R ñ c,s (col(a)) = R ñ c,s (a) = a. Therefore R ñ c,s (col(sστ )) = a = sσ ′ τ ′ .
(a) either col(sστ ) = f (col(t 1 στ ), . . . , col(t n στ )), in which case R ñ c,s (col(sστ )) is by definition f (R ñ c,s (col(t 1 στ )), . . . , R ñ c,s (col(t n στ ))). By the induction hypothesis,

R ñ c,s (col(t i στ )) = E t i σ ′ τ ′ for all 1 ≤ i ≤ n and therefore R ñ c,s (col(sστ )) = E f (t 1 σ ′ τ ′ , . . . , t n σ ′ τ ′ ) = sσ ′ τ ′ . (b) or f (col(t 1 στ ), . . . , col(t n στ )) = C[[u 1 , . . . , u m ]], C[n 1 , . . . , n m ] = E d n x where n 1 , . . . , n m are fresh names such that n i = n j iff u i = E u j (1 ≤ i, j ≤ m), where c ∈ {a, b} is such that f ∈ F d and col(sστ ) = u x . As C[n 1 , . . . , n m ] = E d n x and E d ⊆ E, we have that C[n 1 , . . . , n m ] = E n x .
As C is not the empty context, we have that each u i (1 ≤ i ≤ m is a subterm of some term col(t j στ ) (for 1 ≤ j ≤ n). Therefore, by Lemma 6.4, we have that col(u i ) = u i . Therefore the left-hand side of the equality we are trying to prove is R ñ c,s (col(sστ )) = R ñ c,s (u x ). But the right-hand side (from hereon rhs) of the equality is sσ

′ τ ′ = f (t 1 σ ′ τ ′ , . . . , t n σ ′ τ ′ ). By the induction hypothesis t i σ ′ τ ′ = E R ñ c,s (col(t i στ )) for all 1 ≤ i ≤ n. Therefore the rhs is sσ ′ τ ′ = E f (R ñ c,s (col(t 1 στ )), . . . , R ñ c,s (col(t n στ ))), which is equal, by the definition of R ñ c,s , to R ñ c,s (f (col(t 1 στ ), . . . , col(t n στ ))). But f (col(t 1 στ ), . . . , col(t n στ )) = C[[u 1 , . . . , u m ]] and therefore the rhs is sσ ′ τ ′ = E R ñ c,s (C[u 1 , . . . , u m ]). As C is a pure c-context, it follows that R ñ c,s (C[u 1 , . . . , u m ]) = C[R ñ c,s (u 1 ), . . . , R ñ c,s (u m )]
. By the choice of n 1 , . . . , n m , we have that n i = n j implies u i = E u j , which implies, by Lemma 6.7

, R ñ c,s (col(u i )) = E R ñ c,s (col(u j )). As col(u i ) = u i for all 1 ≤ i ≤ m, we obtain that n i = n j implies R ñ c,s (u i ) = E R ñ c,s (u j ). As C[
)] = E R ñ c,s (u x ). Therefore sσ ′ τ ′ = E C[R ñ c,s (u 1 ), . . . , R ñ c,s (u m )] = E R ñ c,s (u x ).
We have shown that both the lhs R ñ c,s (col(sστ )) = R ñ c,s (u x ) and the rhs sσ ′ τ ′ = E R ñ c,s (u x ) are equal modulo E to the same term and therefore R ñ c,s (col(sστ )) = E sσ ′ τ ′ .

We are now ready to prove Theorem 6.1.

Theorem 6.1. Assume ϕ 0 ⊢ tσ for any t ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } and that

x i σ 0 = E y j σ 0 for all 1 ≤ i ≤ p ′ , 1 ≤ j ≤ q ′ . Then there exist S ′ , ϕ ′ , σ ′ such that (R ′′ , ∅, ∅) l1,...,l k , § -----→ * (S ′ , ϕ ′ , σ ′ ) (6.2)
and 1. if r is a minimal recipe such that ϕ ⊢ r xσ 0 for some x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ }, then ϕ ′ ⊢ r x d σ ′ 0 for some d ∈ {a, b}.

otherwise, if

ϕ ⊢ r xσ for x ∈ Var (P ) ∪ Var (Q) \ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } then ϕ ′ ⊢ r x d σ ′ for some d ∈ {a, b}. Furthermore, if x, y ∈ Dom(σ) are such that xσ = E yσ and x d , y d ∈ Dom(σ ′ ) for some d ∈ {a, b}, then x d σ ′ = E y d σ ′ . Proof.
Assumption 1. We assume w.l.o.g. that fresh names chosen by actions P j = νx (1 ≤ j ≤ n) in R ′′ coming from P are from N a and that fresh names chosen by actions

Q j = νx (1 ≤ j ≤ m) in R ′′ coming from Q are from N b .
Let {n i } 1≤i≤p ′ , {m i } 1≤i≤q ′ be fresh names such that:

1. n i = n j iff x i σ 0 = E x j σ 0 for all 1 ≤ i, j ≤ p ′ , 2. n i = m j iff x i σ 0 = E y j σ 0 for all 1 ≤ i ≤ p ′ , 1 ≤ j ≤ q ′ and 3. m i = m j iff y i σ 0 = E y j σ 0 for all 1 ≤ i, j ≤ q ′ .
Let s denote the sequence of secrets shared between the two protocols s = x 1 σ 0 , . . . , x p ′ σ 0 , y 1 σ 0 , . . . , y q ′ σ 0 and ñ denote the fresh names chosen above associated with these shared secrets:

ñ = n 1 , . . . , n p ′ , m 1 , . . . , m q ′ .
Let ϕ ′ = R ñ a,s (col(ϕ)) and let σ ′ be defined as follows:

1. σ ′ (x a ) = R ñ a,s (col(σ(x))) for all variables x ∈ Var (P ) of P ,

2. σ ′ (x b ) = R ñ b,s (col(σ(x))) for all variables x ∈ Var (Q) of Q, 3. σ ′ (z i ) = n i for all 1 ≤ i ≤ p ′ and 4. σ ′ (z i ) = m i for all 1 ≤ i ≤ q ′ . Let W i = R i . . . . .R n+m and W ′ i = R ′ i . . . . .R ′ n+m denote suffixes of the traces R and R ′ for all 1 ≤ i ≤ n + m. We let W n+m+1 = W ′ n+m+1 = 0. We have by hypothesis that (R, ∅, ∅) l1,...,l k ----→ * (S 0 , ϕ 0 , σ 0 ) § -→ (S, ϕ, σ). (6.3)
Therefore there exist ϕ 1 , . . . , ϕ l , σ 1 , . . . , σ l such that:

(W 1 , ϕ 1 , σ 1 ) §1 -→ (W 2 , ϕ 2 , σ 2 ) §2 -→ . . . § l-1 ---→ (W l , ϕ l , σ l ) § -→ (S, ϕ, σ),
where ϕ 1 = {} is the empty frame and σ 1 = {} is the identity substitution. We also have that ϕ l = ϕ 0 and that σ l = σ 0 .

We have that for all 1

≤ i ≤ l, ϕ i = ϕ[W i ] for some W i ∈ W is a restriction of ϕ and σ i = σ[fv (W i )] is a restriction of σ. For all 1 ≤ i ≤ l, let ϕ ′ i = ϕ ′ [W i ] and σ ′ i = σ ′ [fv (W ′ i )
] be the corresponding restriction on ϕ ′ and σ ′ .

(t)) ⊆ {z 1 , . . . , z r } ⊎ {z ′ 1 , . . . , z ′ r ′ } for some set of variables {z 1 , . . . , z r , z ′ 1 , . . . z ′ r ′ }, 2. a substitution π i d (t) with Dom(π i d (t)) = {z 1 , . . . , z r } such that π i d (t)(z j ) ∈ E {x 1 σ 0 , . . . , x p ′ σ 0 , y 1 σ 0 , . . . , y q ′ σ 0 }
for all 1 ≤ j ≤ r where ∈ E denotes membership modulo E and 3. a substitution

τ i d (t) with Dom(τ i d (t)) = {z ′ 1 , . . . , z ′ r ′ } such that τ i d (t)(z ′ j ) = r d j ϕ i for some recipe r d j for all 1 ≤ j ≤ r ′ such that tσ = E s i d (t)π i d (t)τ i d (t) (6.4) and tR ñ a,s (col(σ)) = E s i d (t)R ñ a,s (col(π i d (t)))R ñ a,s (col(τ i d (t))). (6.5)
Proof. We will show that the claim holds by induction on (i, |t|) equipped with the lexicographic order.

1. for i = 1, we have that fv

(W i ) = fv (R) = ∅ and therefore t ∈ T (F d , N d ∪ M d ). We choose s i d (t) = t, π i d (t) = {} and τ i d (t) = {} to conclude. 2. for i ≥ 2, we distinguish between the following cases: (a) if t = n ∈ N d ∪ M d , we choose s i d (t) = t, π i d (t) = {} and τ i d (t) = {} to conclude. (b) if t = x ∈ fv (W i-1 ), we choose s i d (t) = s i-1 d (t), π i d (t) = π i-1 d (t) and τ i d (t) = τ i-1 d (t) to conclude. (c) if t = x ∈ fv (W i ) \ fv (W i-1
), we have one of the following cases: i. either W i = νx.W i+1 , in which case we distinguish between the following cases:

A. if x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } then we let s i d (x) = z d for a fresh variable ii. or W i = receive(x).W i+1 , in which case we let s i d (x) = z d for a fresh variable z d ∈ X d , π i d (x) = {} and τ i d (x) = {z d → r i ϕ i } to conclude. iii. or W i = (x := s).W i+1 for some term s, in which case we distinguish two cases:

z d ∈ X d , π i d (x) = {z d → σ(x)
A. if x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ }, then we let s i d (x) = z d for a fresh variable z d ∈ X d , π i d (x) = {z d → σ(x)} and τ i d (x) = {} to conclude. B. otherwise x appears in only one of P = T (a) or Q = T (b). Assume that it only appears in T (e) for e ∈ {a, b}. In this case, s is a pure e-term and we choose s i e (x) = s i-1 e (s), π i e (x) = π i-1 e (s) and τ i e (x) = τ i-1 e (s) to conclude.

(d) if t = f (t 1 , . . . , t k ) for a function symbol f ∈ F a of arity ar(f ) = k, then we choose s i d (t) = f (s i d (t 1 ), . . . , s i d (t k )), π i d (t) = 1≤j≤k π i d (t j ) and τ i d (t) = 1≤j≤k τ i d (t j ) to con- clude.
In each of the cases, Equation (6.4) and Equation (6.5) follows by syntactic simplifications.

We next show that:

(R ′′ , ∅, ∅) - → * (W ′ 1 , ϕ ′ 1 , σ ′ 1 ) §1 -→ (W ′ 2 , ϕ ′ 2 , σ ′ 2 ) §2 -→ . . . § l-1 ---→ (W ′ l , ϕ ′ l , σ ′ l ) § -→ (S ′ , ϕ ′ , σ ′ ) We have that σ ′ 1 = σ[fv (R ′ )] = {z i → n i } 1≤i≤n ∪{z p+i → m i } 1≤i≤m ∪{x a i → n i } 1≤i≤p ′ ∪{y b i → m i } 1≤i≤q ′ where fv (R ′ ) = {z i } 1≤i≤p+q ∪ {x a i } 1≤i≤p ′ ∪ {y b i } 1≤i≤q ′ . We immediately have that the transitions (R ′′ , ∅, ∅) - → * (R ′ , ϕ ′ 1 , σ ′ 1 ) succeed by definition of R ′′ and choice of n ′ 1 , . . . , n ′ p , m ′ 1 , . . . , m ′ q . But R ′ = W ′ 1 by choice of W ′ 1 and therefore (R ′′ , ∅, ∅) - → * (W ′ 1 , ϕ ′ 1 , σ ′ 1 ). For all 1 ≤ i ≤ l, we prove that (W i , ϕ i , σ i ) §i -→ (W i+1 , ϕ i+1 , σ i+1 ) implies (W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i+1 , σ ′ i+1 ). (6.6)
We assume that W i = P j .W i+1 with P j being an action in P , since the case where W i = Q j .W i+1 with Q j being an action in Q is completely analogous. We distinguish among five cases:

1. if P j = νx, then W i = νx.W i+1 . As (W i , ϕ i , σ i ) §i -→ (W i+1 , ϕ i+1 , σ i+1 ), we have that § i is the empty string, ϕ i+1 = ϕ i and σ i+1 = σ i ∪ {x → n} where n ∈ N a is a fresh name.

By definition, we have that

W ′ i = νx a .W ′ i+1 , ϕ ′ i+1 = R ñ a,s (col(ϕ i+1 )) = R ñ a,s (col(ϕ i )) = ϕ ′ i and σ ′ i+1 = σ ′ i ∪ {x a → R ñ a,s (col(σ(x)))} = σ ′ i ∪ {x a → n}.
As n was chosen to be fresh and as

x a ∈ Dom(σ ′ i ), it follows that (νx a .W ′ i+1 , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i , σ ′ i ∪ {x a → n}). But W ′ i = νx a .W ′ i+1 , ϕ ′ i+1 = ϕ ′ i and σ ′ i+1 = σ ′ i ∪ {x a → n} and therefore (W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i+1 , σ ′ i+1 ),
which is what we had to prove.

if P

j = receive(x), then W i = receive(x).W i+1 . As (W i , ϕ i , σ i ) §i -→ (W i+1 , ϕ i+1 , σ i+1 ), we have that § i = receive(r i ) for some recipe r i , ϕ i+1 = ϕ i and σ i+1 = σ i ∪ {x → r i ϕ i }.
By definition, we have that

W ′ i = receive(x a ).W ′ i+1 , ϕ ′ i+1 = R ñ a,s (col(ϕ i+1 )) = R ñ a,s (col(ϕ i )) = ϕ ′ i and σ ′ i+1 = σ ′ i ∪ {x a → R ñ a,s (col(σ(x)))} = σ ′ i ∪ {x a → R ñ a,s (col(r i ϕ i ))}.
As ϕ i is a restriction of ϕ 0 = ϕ l to a smaller domain, we have that ϕ i ⊢ t for any t ∈ {x 1 σ 0 , . . . , x p ′ σ 0 , y 1 σ 0 , . . . , y q ′ σ 0 }. Therefore, by Lemma 6.9, we have that r

i R ñ a,s (col(ϕ i )) = E R ñ a,s (col(r i ϕ i )). This is equivalent to r i ϕ ′ i = E R ñ a,s (col(σ(x)), which is equivalent to ϕ ′ i ⊢ ri R ñ a,s (col(σ(x))). Therefore (receive(x a ).W ′ i+1 , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i , σ ′ i ∪{x a → R ñ a,s (col(σ(x)))}). But W ′ i = receive(x a ).W ′ i+1 , ϕ ′ i+1 = ϕ ′ i and σ ′ i+1 = σ ′ i ∪ {x a → R ñ a,s (col(σ(x)))} and there- fore (W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i+1 , σ ′ i+1 )
, which is what we had to prove.

if P

j = (x := t), then W i = (x := t).W i+1 . As (W i , ϕ i , σ i ) §i -→ (W i+1 , ϕ i+1 , σ i+1 ), we have that § i is the empty string, ϕ i+1 = ϕ i and σ i+1 = σ i ∪ {x → tσ i }.
By definition, we have that

W ′ i = (x a := t{y → y A } y∈Var (t) ).W ′ i+1 . Therefore (W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i , σ ′ i ∪ {x a → t{y → y a } y∈Var (t) σ ′ i }).
But we have that:

t{y → y a } y∈Var (t) σ ′ i = tR ñ a,s (col(σ)) (by choice of σ ′ ) = E s i a (t)R ñ a,s (col(π i a (t)))R ñ a,s (col(τ i a (t))) (by Claim 6.1) = E R ñ a,s (col(s i a (t)π i a (t)τ i a (t))) (by Lemma 6.10) = E R ñ a,s (col(tσ)) (by Claim 6.1, Lemma 6.7) = E R ñ a,s (col(σ(x))) (by choice of σ) = E σ ′ (x a ) (by definition of σ ′ ) Figure 6.4: Transformation of t{y → y a } y∈Var (t) σ ′ i and therefore σ ′ i+1 = E σ i ∪{t{y → y a } y∈Var (t) σ ′ i }. We also have that ϕ ′ i+1 = R ñ a,s (col(ϕ i+1 )) = R ñ a,s (col(ϕ i )) = ϕ ′ i and therefore (W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i+1 , σ ′ i+1 ),
which is what we had to prove.

4. if P j = send(t), we have that

W i = send(t).W i+1 . As (W i , ϕ i , σ i ) §i -→ (W i+1 , ϕ i+1 , σ i+1 ), we have that § i is the empty string, ϕ i+1 = ϕ i ∪ {w |Dom(ϕi)|+1 → tσ i } and σ i+1 = σ i .
By definition, we have that

W ′ i = send(t{y → y A } y∈Var (t) ).W ′ i+1 . Therefore (W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i ∪ {w |Dom(ϕ ′ i )|+1 → t{y → y a } y∈Var (t) σ ′ i }, σ ′ i )
. By a transformation identical to Figure 6.4, we have that t{y → y a } y∈Var (t) σ ′ i = E R ñ a,s (col(tσ)). Therefore ϕ ′ i+1 = ϕ ′ i ∪ {w |Dom(ϕ ′ i )|+1 → R ñ a,s (col(tσ))} = E t{y → y a } y∈Var (t) σ ′ i . Moreover, σ ′ i+1 = σ ′ i and therefore

(W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i+1 , σ ′ i+1 )
, which is what we had to prove. 5. if P j = [s = t], we have that W i = [s = t].W i+1 . As (W i , ϕ i , σ i ) §i -→ (W i+1 , ϕ i+1 , σ i+1 ), we have that § i is the empty string, ϕ i+1 = ϕ i , σ i+1 = σ i and sσ = E tσ.

By definition, we have that W ′ i = [s{y → y A } y∈Var (s) = t{y → y A } y∈Var (t) ].W ′ i+1 . By transformations identical to those in Figure 6.4, we have that t{y → y a } y∈Var (t) σ ′ i = E R ñ a,s (col(tσ)) and that s{y → y a } y∈Var (s) σ ′ i = E R ñ a,s (col(sσ)). But as s = E t, we have that R ñ a,s (col(sσ)) = E R ñ a,s (col(tσ)) by Lemma 6.7. Therefore t{y → y a } y∈Var (t) σ ′ i = E s{y → y a } y∈Var (s) σ ′ i and we have that (

W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i , σ ′ i ). But ϕ ′ i+1 = ϕ ′ i and σ ′ i+1 = σ ′ i and therefore (W ′ i , ϕ ′ i , σ ′ i ) §i -→ (W ′ i+1 , ϕ ′ i+1 , σ ′ i+1 )
, which is what we had to prove.

We have shown that Equation (6.2) holds. It remains to show that:

1. if r is a minimal recipe such that ϕ ⊢ r xσ 0 for some x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ }, then ϕ ′ ⊢ r x d σ ′ 0 for some d ∈ {a, b}. As ϕ 0 ⊢ E xσ 0 for any variable x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } and as ϕ ⊢ r E xσ 0 for some variable x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ }, it follows that ϕ = E ϕ 0 . As (S 0 , ϕ 0 , σ 0 ) § -→ (S, ϕ, σ), we have that S 0 = send(t).S for some action send(t) = P j ∈ P (for some 1 ≤ j ≤ n) or send(t) = Q j ∈ Q (for some 1 ≤ j ≤ m), ϕ = ϕ 0 ∪ {w |Dom(ϕ0)|+1 → tσ 0 } and that σ = σ 0 .

We will show that ϕ ′ ⊢ r x d σ ′ for some d ∈ {a, b}. Clearly the recipe r ∈ M is not a name, since otherwise ϕ 0 ⊢ r xσ 0 . If r = w k for some 1 ≤ k ≤ |Dom(ϕ)|, then ϕ ′ ⊢ r R ñ a,s (col(tσ 0 )) by the definition of ϕ ′ . But as ϕ ⊢ r tσ 0 , we have that tσ 0 = E xσ and x d σ ′ = R ñ a,s (col(xσ)) by definition of σ ′ and we obtain x a σ ′ = R ñ a,s (col(tσ 0 )) by Lemma 6.7. Therefore ϕ ′ ⊢ r x a σ. Otherwise r = f (r 1 , . . . , r l ) for some recipes r 1 , . . . , r l . By minimality of r, we have that any subrecipe r ′ ⊑ r i (1 ≤ i ≤ l) of r 1 , . . . , r l is not a recipe for any yσ with y ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ }. 2. otherwise, if ϕ ⊢ r xσ for x ∈ Var (P ) ∪ Var (Q) \ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } then ϕ ′ ⊢ r x d σ ′ for all d ∈ {a, b}.

We have that rϕ = E xσ. By Lemma 6.7 we obtain that R ñ a,s (col(rϕ)) = E R ñ a,s (col(xσ)). We have by Lemma 6.9 that R ñ a,s (col(rϕ)) = E rR ñ a,s (col(ϕ)) and therefore we obtain that rR 6.5 Applications 6.5.1 Some Further Useful Lemmas Theorem 6.1 is our key result for composing processes. We list here some other useful (and rather straightforward) results that we will use in our applications to secure protocol composition. We denote by T races(P ) the set of traces of P . It intuitively consists of the set of all possible interleaving for the executions of P . We will use this set of reason about protocols containing parallel composition and replications using Theorem 6.1. Definition 6.6. We say that P binds x if P = P 1 .P 2 . . . . .P n and P j ∈ {receive(x), x := t, νx} for some 1 ≤ j ≤ n and some term t (note that P 1 , . . . , P n are not necessarily atomic). Intuitively, the protocol P corresponds to two roles P 1 and P 2 that establish a key k stored respectively in x k for P 1 and in y k for P 2 . Then each of the two roles Q 1 and Q 2 of Q uses respectively its version of the key. Theorem 6.2 ensures that the protocol P can be safely abstracted by the generation of a single fresh key, distributed among the participants.

This result could easily be extended to an arbitrary number of roles. Note that Q 1 and Q 2 may contain replications thus the key k may be used in several distinct sessions.

Proof. If d ∈ {a, b} and if P is a process, we denote by P d the process in which any occurrence of a variable x ∈ Var (P ) has been replaced by the variable x d .

We do a proof by contradiction. We assume that W |= E Secret(x s ). Then, by Lemma 6.11, we have that there exists a trace R ∈ T races(W ) of W such that R |= E Secret(x s ).

The trace R is then a ground interleaving of a trace P 0 ∈ T races(P ) and a trace Q 0 ∈ T races(Q 1 | Q 2 ). We denote by R ′ the same ground interleaving of P a 0 and Q b 0 . As R |= E Secret(x s ), there is a run (R, ∅, ∅) §1 -→ (R 1 , ϕ 1 , σ 1 ) §2 -→ . . . §m --→ (R m , ϕ m , σ m ) such that ϕ m ⊢ x s σ m .

Let 1 ≤ l ≤ m be the first index such that ϕ l ⊢ x k σ l or ϕ l ⊢ y k σ l or ϕ l ⊢ x s σ l . We can then apply Theorem 6.1 to obtain that the process , we obtain that P |= Ea Secret(z) for some z ∈ {x k , y k } or that Q |= E b Secret(z) for some z ∈ {x k , y k , x s }. In both cases, this contradicts the hypotheses. We thus deduce that W |= E Secret(x s ).

R ′′ =

Secure Channels

Another composition scenario is when a protocol is proven secure assuming some secure channels, that is, assuming that some secret key is established on the fly. We show that the secure channel can be implemented by any sub-protocol provided that neither the main protocol nor the subprotocol reveal the key. Compared to Theorem 6.2, the two roles Q 1 and Q 2 now use a different key k in each session.

Proof. We prove the result by contradiction along the same lines as the proof of Theorem 6.2. We assume that W |= E Secret(x s ). Then, by Lemma 6.11, we have that there exists a trace R of W such that R |= E Secret(x s ).

R is then a ground interleaving of a trace P 0 ∈ T races(P ) and a trace Q 0 ∈ T races(!(Q 1 | Q 2 )). We denote by R ′ the same ground interleaving of P a 0 and Q b 0 . As R |= E Secret(x s ), there is a trace in which a participant Q 1 sends a secret x s to the second participant using a shared key y k . Assume that Q is defined over the signature F enc and that Q |= Eenc Secret(x s ). Then the sequential composition of P DH and Q, where P DH is used to establish the shared key used in Q is defined by

W = νx k .(P 1 .Q 1 | P 2 .Q 2 )
Applying Theorem 6.2, W |= EDH∪Eenc Secret(x s ), that is W does not leak x s in the theory E DH ∪ E enc .

Tagging

We have shown so far how to compose processes that use disjoint equational theories. However, this hypothesis is not always realistic since protocols often share usual cryptographic primitives such as symmetric encryption (for example, many protocols use AES). In this section, we show that protocols which do share common cryptographic primitives, such as encryption and hash functions, can also be securely composed in the same manner, as long as the two protocols are tagged differently.

Tagging is a syntactic transformation of a protocol in order to make it, for example, more resistant against attacks. Many ways to tag protocols have been proposed in different contexts, e.g. for composing protocols [START_REF] Guttman | Protocol independence through disjoint encryption[END_REF][START_REF] Cortier | Safely composing security protocols[END_REF] as discussed in introduction, to facilitate the analysis [START_REF] Blanchet | Verification of cryptographic protocols: Tagging enforces termination[END_REF][START_REF] Ramanujam | Tagging makes secrecy decidable for unbounded nonces as well[END_REF] or to prevent type-flow attacks [START_REF] Heather | How to prevent type flaw attacks on security protocols[END_REF]. Typically, tagging a security protocol consists in appending a tag (e.g. a number, a nonce or a protocol identifier) to each plaintext before encrypting it and removing the tag after decryption. Tagging a protocol does not introduce additional attacks in the protocol, while preserving its communication goals.

We show that if two protocols share cryptographic primitives such as symmetric encryption and hash functions are tagged differently, then their composition is secure as long as the same problems detailed in Section 6.3.1 and Section 6.3.3 are avoided.

Our proof technique relies on our previous theorems, in that we show that an attack against the composition of two differently tagged protocols can be transformed into an attack where the protocols use disjoint encryption and hash functions. Therefore, tagging essentially enforces the disjointness of the two protocols.

Tagging a Protocol

We consider protocols over the signature F enc,h = {enc, dec, h} where enc and dec model respectively encryption and decryption and are of arity 2 and h models a hash function and is of arity 1. We also consider the signatures In order to define tagging, we first consider the signature renaming transformation d (d ∈ {a, b}) which assigns to a protocol P over F enc,h a protocol P d (d ∈ {a, b}) over the signature F d enc,h such that the two protocols are identical modulo bijective renaming of functions symbols (enc, dec and h are transformed into enc d , dec d and h d , respectively, and this transformation is extended homomorphically to the entire protocol). Example 6.7. If P = νy.receive(x).send(dec(x, y)), then P a = ν(y).receive(x).send(dec a (x, y)). If [enc(dec(x, y), y) = x].send(untag a (dec(x, y))).

Note that before performing the decryption, the process [|P a |] verifies that it is decrypting a message which has been tagged with a. Theorems 6.5 and 6.6 allow us to securely compose key-exchange protocols which make use of symmetric encryption with protocols which use the exchanged keys, as long as the two protocols are tagged differently and if they obey the security requirements detailed above.

We have seen that Example 6.9 explains the need to tag the encryptions in order to obtain secure composition. One might think that tagging encryptions is sufficient to ensure the security of the composition and that it is not necessary to tag the hash function as well. Unfortunately, this is not true. We end this section on tagging by an example which illustrates why tagging is necessary for the hash function as well. We have that the protocol P does not reveal x. The protocol νx.Q reveals neither z nor x. However, if P is used to instantiate the variable x for Q, we have that

P.Q |= Secret(z).
By Theorem 6.4, we have however that the tagged composition does satisfy the secret of z:

[|P a |].[|Q b |] |= Secret(z).

Conclusion and Future Work 6.7.1 Conclusion

We have shown in this chapter that protocols can be securely composed provided that they use primitives modeled by disjoint equational theories or provided that their only primitives are tagged encryptions or tagged hash functions.

Our result is a generic composition result: any trace leading to an attack on the composition of the two protocols is transformed into a trace that leads to an attack in one of the individual protocols, even if the two protocols share secrets such as keys. This allows us to securely perform several kinds of compositions. We can have secure parallel composition under shared secrets or we can have an asymmetric composition, where one of the protocols is used as a sub-protocol. As a matter of fact, our combination theorem could actually be used in any context where two protocols are arbitrarily interleaved and use shared data.

As an application, we have shown how our main composition theorem can be used in order to securely refine a protocol that uses pre-established keys or secure channels.

For the sake of simplicity, the only security property that we have considered is secrecy. We believe however that our result extends to general trace properties (e.g. authentication). This is because our trace transformation proof technique transforms any trace of the composition of two protocols under shared secrets (as long as a shared key is not revealed) into a trace on the composition under no shared secrets. This means that any violation of authentication in the composed protocol would be transformed into a violation of authentication on one of the individual protocols.

We have proven that primitives can be shared between the protocols provided they are tagged, in the case of symmetric encryption and hash. Even though we prove this only for symmetric encryption and hash functions, we believe that our technique can be extended to other usual cryptographic primitives such as asymmetric encryption and digital signature. Other cryptographic primitives can pose more problems (for example it is not obvious if/how the eXclusive OR can be tagged). It is an interesting open problem to give a generic definition of tagging and characterize which cryptographic primitives can be tagged.

Dishonest Participants

As we have shown in Section 6.3.1, one of the hypothesis that we use in order for our composition theorem to work is that the two processes involved do not leak shared keys. Unfortunately, this makes our composition theorem unable to cope with dishonest participants because dishonest participants leak everything to the intruder (in some sense, they are the intruder). Let P = νk.(P 1 | P 2 ) is a key-exchange protocol with two participants P 1 and P 2 , with P 1 storing the exchanged key in variable x k and P 2 storing the exchanged key in variable y k . Let

Q = νx.((x k := x).Q 1 | (y k := y).Q 2 )
be a protocol which uses the exchanged keys x k , y k (assumed to be freshly chosen in Q). We have shown that the sequential composition of P and Q is secure as long as P and Q are over disjoint equational theories and do not leak the shared keys. However, assuming for example that the participant playing the role P 2 and Q 2 is dishonest, all of the keys involved are leaked and therefore we cannot apply our composition theorem. This is the main limitation of our work. Therefore the most important direction for future work is to investigate which additional conditions are needed to handle composition in the presence of dishonest participants. It is clear that the assumption that shared keys are not revealed needs to be weakened, but there needs to be a condition that replaces it.

One of the main ingredients of our composition theorem is that a sequence l 1 , . . . , l k of intruder actions leading to an attack in an interleaving of two traces leads to the same attack when the traces no longer share anything. In the case of dishonest participants, this is no longer the case and the sequences of intruder actions needs to be slightly altered as shown in the following example: Example 6.11. Let P = νz.send(z) and Q = send(z).receive(x 1 ).receive(x 2 ).[x1 = x2].send(s). The variable z is supposed to be a key generated by P for Q and s is a private name. However a "participant" detaining the key z is dishonest and leaks it as soon as possible on the network. We have that (P.Q, ∅, ∅) receive(w1),receive(w2) ----------------→ * (0, ϕ, σ) for some substitution σ and with ϕ = {w 1 → k 1 , w 2 → k 1 , w 3 → s} where k 1 is a fresh name. In the spirit of our composition theorem, we would like that the same intruder actions receive(w 1 ), receive(w 2 ) to work in the case where P and Q used disjoint variables. However, we have that P.νz ′ .(Q{z → z ′ }) = νz.send(z).νz ′ .send(z ′ ).receive(x 1 ).receive(x 2 ).[x1 = x2].send(s) blocks at the test [x 1 = x 2 ] since x 1 will be bound to k 1 and x 2 bound to k 2 for fresh names k 1 , k 2 . Therefore the same intruder actions that were used to get P.Q to output s will not work to get P.νz ′ .(Q{z → z ′ }) to output s. In this case, it is easy to see that it is possible to easily tweak the intruder actions (i.e. change ----------------→ * (0, {w 1 → k 1 , w 2 → k 2 , w 3 → s}, σ ′ ) to output s. However, finding a generic way to change the intruder actions in order to obtain the same attack is an open problem and would allow to have a theorem for composition which is sound even in the presence of dishonest participants.

Directions for Future Work

A direction for future work is to investigate if composition with disjoint equational theories preserves trace equivalence, as defined e.g. in Chapter 5 and more generally other behavioral equivalences which can be used to reason about security properties such as anonymity. As in our composition theorem we reason about recipes, there is hope that the our result carries over to equivalence properties.

We have shown that protocols which have disjoint equational theories compose well and protocols that are tagged compose well. A possible direction for future work is a straightforward generalization of our composition result which combines the equational composition result and the tagging composition result as follows: show that the composition of two protocols which make use of some common cryptographic primitives (and possibly other primitives which are individual to each protocol) compose well as longs as the common primitives are tagged (and the primitives which are particular to each protocol are kept intact).

Also, certain primitives which seem harmless enough that they may be shared without tagging them. For example, the concatenation defined through the equational theory: fst(pair(x, y)) = x snd(pair(x, y)) = y.

is a candidate. However, let us consider the processes P = νx.νy.z := pair(x, y) Q = νk.send(enc(z, k)).receive(y).send(pair(fst(dec(y, k)), snd(dec(y, k)))).

The process νz.Q does not reveal z. However, if the generation of z is handled by P , we have that P • Q does reveal z. This is because Q was only verified secure when z is instantiated to a name. We are trying to prove that the equational theory of pair can be safely shared between two protocols as long as neither of the protocols instantiates a shared key to a pair.

Finally, many relevant equational theories are not so easy to tag. In particular, tagging exclusive or is particularly difficult. Finding a way to securely compose two protocols which both make use of this primitive (the exclusive or ) is a challenging open problem.

Chapter 7

Conclusion and Perspectives

We have presented methods that allow us to increase our confidence in the security of cryptographic protocols with applications to e-voting protocols. We have seen that e-voting protocols are different from other previously analyzed protocols in two aspects:

1. they employ novel cryptographic primitives such as blind signatures, trapdoor commitment and homomorphic encryption and 2. the security properties desirable of them are fundamentally different from confidentiality and authentication, which were the most studied security properties.

In this thesis, we show that automated verification of security protocols with respect to equivalence properties is feasible and that protocols making use of arbitrary disjoint cryptographic primitives compose well with respect to confidentiality. Chapters 3 to 5 consist of techniques for the automated verification of equivalence properties and Chapter 6 consists of the composition result. We believe that both directions (automated verification and compositionality) provide fruitful ground for further research.

In Chapter 3 we have introduced and motivated the notion of strongly complete set of variants. This notion is used as a base brick in Chapter 5 for the automated procedure for proving equivalence properties. Strongly complete sets of variants allow to get rid of the equational theory modeling the properties of the cryptographic primitives and solve the resulting problem in the free term algebra.

Therefore, in order to be able to handle a greater variety of cryptographic primitives, a first step is to prove that the equational theory modeling the new primitives still has the strong finite variant property. However, for cryptographic primitives such as XOR, this cannot be the case because they contain associative-commutative (AC) function symbols. Therefore no convergent term rewriting system can model XOR. Instead, the notion of strongly complete set of variants should be extended to a convergent rewrite system R modulo an equational theory E. The primitive XOR could then be split into two parts: E would model the AC property of XOR while R would model that 0 is a neutral element and that by XORing a value with itself we obtain the neutral element 0.

As it might be cumbersome to establish the strong finite variant property, it would be nice to obtain a combination result: assuming two disjoint rewrite systems (F a , R a ) and (F b , R b ) have the strong finite variant property (eventually modulo an equational theory), does (F a ∪F b , R a ∪R b ) also have the SFVP? Are strongly complete sets of variants for mixed terms (with function symbols from F a and from F b ) effectively constructible from strongly complete sets of variants of pure terms (with function symbols only from F a or only from F b )?

In Chapter 4 we have presented a decision procedure for static equivalence. The procedure is sound and complete for any convergent equational theory, but termination currently needs to be established on a case-by-case basis. We have shown termination for several (classes of) equational theories, but it would be interesting to obtain an exact characterization of the class of equational theories for which the saturation procedure terminates.

The procedure we present does not terminate for an equational theory modeling re-encryption, a cryptographic primitives which can be used in designated verifier proofs of re-encryption as in [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. The reason for non-termination is illustrated in Example 4.11 using a toy equational theory which presents the same difficulties as re-encryption. Extending the procedure to handle this equational theory in a generic fashion is an interesting open problem and it would allow (partial) automation of security proof for electronic voting protocols which make use of designated verifier proofs.

Another direction for future work would be to extend the procedure to handle cryptographic primitives such as XOR which cannot be modeled by a convergent rewrite system. To handle such theories, an idea is to keep the current structure of the saturation procedure but to perform matching and unification modulo AC. Soundness, completeness and termination for this approach should be investigated.

In Chapter 5 we have presented a procedure for verifying trace equivalence for determinate processes. This procedure has allowed us to obtain the first automated proof of vote privacy for the electronic voting protocol FOO. However, the procedure presents several limitations which should be lifted:

1. We have conjectured that the saturation procedure always terminates for subterm convergent rewrite systems. Due to the highly complex form of Horn clauses generated during saturation, we have not been able to prove this. However, this should be further investigated. Proving termination would imply a strict theoretical extension of previous results [START_REF] Chevalier | Decidability of equivalence of symbolic derivations[END_REF][START_REF] Baudet | Deciding security of protocols against off-line guessing attacks[END_REF] from traces to determinate processes.

2. Currently, our procedure only handles bounded processes. This restriction can be lifted by allowing sound abstractions in the style of [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF]. Abstractions would allow to obtain proofs of equivalence for unbounded protocols, but with the possibility of false attacks.

3. Currently in our process algebra only tests of the form [s = t] are permitted. If a test fails, the process blocks. However, some protocols need else branches in order to perform a operation if a test does not succeed. An idea for handling else branches is to use strongly complete set of variants in order to build complete sets of disunifiers for some notion of completeness. This complete sets of disunifiers would then allow to describe exactly for which instantiation of the terms the else branch would be taken.

Handling else branches would allow to obtain security proofs for protocols for the private authentication protocol in [4] or the e-passport protocol in [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF].

4. Even assuming that the saturation procedure terminates, our procedure can establish a proof of equivalence or provide a counter-example for determinate processes only. For processes which are not known to be determinate, we provide a sound proof method to establish equivalence; however, if the proof method fails, we do not know if the processes are equivalent or not. where n, m, k ∈ N are private names. The process {T 1 , T 2 } is not trace-equivalent to the process S (but we cannot prove this using our procedure) intuitively because the intruder can check if the first output is different from the second output and in this case conclude that he is dealing with {T 1 , T 2 } instead of S. This "negative test" is exactly what the current procedure does not handle; instead it only captures positive tests using the predicate i. One idea is to extend the saturation procedure to include a predicate ni which states that two recipes are not the same. This would allow the procedure to directly handle non-determinate processes as well.

5. As we have already pointed out, our procedure works only for convergent rewrite systems but there are cryptographic primitives such as XOR which cannot be modeled by such rewrite systems. Therefore it is necessary to work with a convergent rewrite system modulo a theory of associativity-commutativity (AC). It would be interesting to extend the procedure to handle strongly complete sets of variants, matching and unification modulo AC. The result should be again proven sound and complete.

6. As the equational theory gets more complex, the chances that a given method automatically proves an equivalence between processes diminish. Therefore it is desirable to obtain combination results: if the equational theory is split into two parts and for each part a procedure for proving equivalence is known, can the two procedures be combined into a procedure for verifying equivalence for the larger equational theory?

7. The equivalences that our procedure can prove are in the Dolev-Yao model as opposed to the more realistic computational model. However, there is a result [START_REF] Comon-Lundh | Computational soundness of observational equivalence[END_REF] which links equivalence in the Dolev-Yao model to equivalence in the computational model. As a more distant perspective, bridging the gap between the equivalences that our procedure proves and the equivalences of the computational model is a desirable goal. This could be achieved for example either by a computational soundness result or by modifying the tool so that to fit the computational model better or both.

8. Other perspectives for further research are to extend our procedure to check if a protocol implements an ideal functionality as in [START_REF] Delaune | Simulation based security in the applied pi calculus[END_REF] or to check more complex properties such as individual or universal verifiability of voting protocols as formalized in [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF].

In Chapter 6, we have shown that protocols which use disjoint cryptographic primitives can be securely composed with respect to confidentiality of data if they do not reveal or reuse shared secrets.

We have seen that due to our hypothesis (that shared secrets are not revealed), the main limitation is that the composition theorem cannot be applied for dishonest participants (because they reveal secrets to the adversary as soon as possible). Therefore the most important extension of the composition result in Chapter 6 is to allow composition even in the presence of dishonest users. We have shown (Section 6.7.2) that our theorem does not hold for dishonest participants. Therefore, in order to obtain a composition result in this context, the hypothesis needs to be altered.

Another hypothesis that we make is that the protocols use disjoint primitives. This is not always the case, as both might use, for example, the same encryption algorithms. We mitigate this by proving (for a limited set of primitives) that composition still holds as long as the primitives are tagged. Enlarging the set of primitives for which this is shown is the subject of future work. Furthermore, it would be nice to obtain a composition result in which the primitives which are shared between the two protocols are tagged, while all the other primitives (which are used by one of the two protocols) remain as they are.

Obtaining composition results for indistinguishability properties such as trace equivalence is another natural extension. This would be particularly useful in the case of e-voting protocols, where it could be used to show that vote privacy is preserved even in the presence of other protocols. Other minor extension is to prove the same composition result in the presence of else branches.

More generally, we would like to apply the techniques that we have developed in this thesis to other contexts. We would like to prove other equivalence-based security properties of electronic voting protocols such as coercion-resistance or receipt-freeness [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. Furthermore, the same techniques for verifying trace equivalence could be used in a different context to prove unlinkability [START_REF] Arapinis | Analysing unlinkability and anonymity using the applied pi calculus[END_REF]. Unlinkability is a privacy property which intuitively means that an attacker cannot trace a participant by linking together several uses of a protocol such as the protocol run by the participant during the checking of his electronic passport. Equivalence of processes seems to be well-suited for the verification of privacy properties like anonymity, unlinkability and vote privacy and we would like to investigate other potential applications of trace equivalence such as for verifying privacy in web services or anonymity in routing protocols.

Figure 1 . 1 :

 11 Figure 1.1: Model Checking

Figure 1 . 2 :

 12 Figure 1.2: The secrecy problem

Figure 3 . 1 :

 31 Figure 3.1: Narrowing step (complete for convergent optimally reducing rewrite systems)

Figure 4 . 1 :

 41 Figure 4.1: Predicates (for ground terms t, R)

Definition 4 . 1 .

 41 A statement is a Horn clause of the form

Example 4 . 4 .

 44 Consider the following set K of statements (all of which are true in the frame ϕ 2 defined in the previous examples):

  have already seen that k(enc(w 1 , b), enc(enc(b, k), b)) ∈ deriv(K). Updating the knowledge base by k(w 2 , enc(enc(b, k), b)) ⇐ would result in no modification of the set of deduction statements, since we already know that k(R ′ , enc(enc(b, k), b)) ∈ deriv(K) (with

  2.(⇐)ByLemma 4.3, K| solved |= i(M, N ) implies (M = N )ϕ.

  is a saturated knowledge base we apply Proposition 4.1 and deduce that K ++ | solved |= i(M ′ , N ′ ), and thus K ++ | solved |= i(M, N ), which easily implies K| solved |= i(M, N ).

Example 4 . 10 .

 410 Consider again the frames ϕ 1 and ϕ 2 from Example 4.7. Our procedure returns that the frames are not statically equivalent since i(mal(w 1 , b), w 1 ) ⇐ ∈ K 2 whereas (mal(w 1 , b) = w 1 )ϕ 1 .

Figure 4 . 3 :

 43 Figure 4.3: Optimized saturation rules for solving ground antecedents

Definition 5 . 1 .

 51 An action a is a term in T (F ∪ {receive, send, ? =}, C, N , M, X ) of one of the following types: a = receive(c, x) (receive action) or a = send(c, t) (send action) or a = [s ? = t] (test action) where receive, send, ? = ∈ F are fresh function symbols of arity 2, where c ∈ C is a public channel and where s, t ∈ T (F, N , M, X ). The function symbol ? = is used with infix syntax for clarity: s ? = t is the same as ? = (s, t). The square brackets around the s ? = t action are just for presentation reasons and are not part of the action.

Definition 5 . 2 .

 52 A trace T is a finite sequence of actions T = a 1 .a 2 . . . . .a n .

  ln -→ F ,E (where juxtaposition denotes composition of relations). Example 5.2. Continuing the previous example (T (x) = send(c, enc(x, k)).send(c, k)), we have that (T (yes), ∅) send(c),send(c)

  l1,...,ln ----→ (T, ϕ) (resp. (P, ∅) l1,...,ln ====⇒ (T, ϕ)) if there exists S ∈ P such that (S, ∅) l1,...,ln ----→ (T, ϕ) (resp. (S, ∅) l1,...,ln

Example 5 . 4 .

 54 Let a, b ∈ N be private names, let c ∈ C be a public channel and let P = {send(c, a).send(c, a)}, Q = {send(c, a).send(c, a), send(c, a).send(c, b)}.

Figure 5 . 2 :Example 5 . 7 .

 5257 Figure 5.2: Seed statements associated to T and M 0 ⊆ M

[s 4 ?= t 4 ]

 44 .send(c 5 , t 5 ), where c 1 = c 2 = c 3 = c 5 = c, x 3 = x, t 1 = enc(a, k), t 2 = enc(a ′ , k), s 4 = x 3 = x, t 4 = enc(dec(x 3 , k), k)) = enc(dec(x, k), k) and t 5 = ok. We also have that ℓ 1 = send(c), ℓ 2 = send(c), ℓ 3 = receive(c, x), ℓ 4 = test and ℓ 5 = send(c).

  2). If b ∈ M is a public name, then the statement k(b, b) ⇐ is in the seed set of statements (third type of statement in Figure 5.2).

  (a) if a m = send(c m , t m ), then ℓ m = send(c m ) by definition. Let the trace T m+1 = (a m+1 . . . . .a n ){x j → x j στ ↓ω} j∈R(m) and let ϕ m+1 = ϕ m ∪ {w |Dom(ϕm)|+1 → t m στ ↓ω}. Let L m = send(c m ). By the definition of -→, we have that(T m , ϕ m ) Lm --→ (T m+1 , ϕ m+1 ),which is was we wanted to prove.(b) if a m = [s m ? = t m ], then ℓ m = test. Let T m+1 = (a m+1 . . . . .a n ){x j → x j στ ↓ω} j∈R(m) and let ϕ m+1 = ϕ m . As σ ∈ mgu R ({s k = t k } k∈T (m)), we have that s m σ = R t m σ and therefore s m στ ↓ω = R t m στ ↓ω. Hence the precondition in the definition of -→ holds and by letting L m = test, we have that(T m , ϕ m ) Lm --→ (T m+1 , ϕ m+1 ),which is what we wanted to prove. (c) If a m = receive(c m , x m ), we know that m ∈ R(m). Let T m+1 = (a m+1 . . . . .a n ){x j → x j στ ↓ω} j∈R(m) and let ϕ m+1 = ϕ m . As m ∈ R(m), we have that the trace T |= (k ℓ1στ ↓,...,ℓm-1στ ↓ (X m , x m στ ↓))ω (this is an antecedent of f ). Therefore ϕ m ⊢ Xmω x m στ ↓ω and, by letting L m = receive(c m , X m ω), we obtain by the definition of -→ that (T m , ϕ m ) Lm --→ (T m+1 , ϕ m+1 ),

  which implies ϕ ⊢ w |S(m)| (t m σ)↓ω. We obtain T |= (k ℓ1σ↓,...,ℓmσ↓ (w |S(m)| , t m σ↓))ω by the semantics of k, which is what we wanted to show. (b) otherwise, we trivially have that T |= k ℓ1σ↓,...,ℓmσ↓ (w |S(m)| , (t m σ)↓)ω by the "soft" semantics of k.

Lemma 5 . 2 (

 52 Completeness of the set of seed statements). Let T and S be traces and let ϕ be a frame. If (T, ∅) L1,...,Ln

2 .

 2 By induction on R, we show that: k L1ϕ↓,...,Lnϕ↓ (R, Rϕ↓) ∈ H(Seed(T )) (a) If R = c is a public name, and as the statement f = k(c, c) ⇐ is in the seed knowledge base by definition, we can instantiate f with ω to immediately obtain the solution and immediately get the conclusion by the ExtendK rule. (b) If R = f (R 1 , . . . , R k ), let γ be the substitution of domain Dom(γ) ⊆ {y 1 , . . . , y k } that maps y j to R j ϕ↓ for all 1 ≤ j ≤ k. Let τ ∈ Variants(f (y 1 , . . . , y k )) and τ ′ be such that Rϕ↓ = (f (y 1 , . . . , y k )τ )↓τ ′ . By the definition of Seed(T ), we have that g ∈ Seed(t), where g is the statement g = k ℓ1,...,ℓn (f (Y 1 , . . . , Y k ), f (y 1 τ ↓, . . . , y k τ ↓)) ⇐ {k ℓ1,...,ℓn (Y j , y j τ ↓)} j∈{1,...,k} .

  by the definition of a knowledge base) and y i ∈ Var (t ′ ) by definition of a statement. Hence, |y i σ| < |t ′ σ| = |t|. Example 5.9. Let f = k send(c),send(c) (d, d) ⇐ and g = r send(c),send(c),receive(c,x) ⇐ k send(c),send(c) (X, x) . We have that the statement h = r send(c),send(c),receive(c,d) ∈ deriv({f, g}) is a consequence of the knowledge base {f, g}.

Figure 5 . 3 :

 53 Figure 5.3: Saturation rules We now state in what sense the saturation procedure is sound and complete. The proofs are detailed in Section 5.6 and Section 5.7. Theorem 5.2 (soundness of saturation). If f ∈ sat(K i (T )) then T |= f .

Theorem 5 . 3 (

 53 Completeness of saturation). Let T and S be traces and let ϕ be a frame such that (T, ∅) L1,...,Ln

Lemma 5 . 3 .

 53 Let T be a trace, let M T = {m ∈ M | m ∈ N ames(T )} be the set of public names occurring in T and let M T = M \ M T be the set of public names not occuring in T .Let

  (e) test if (Rω = R ′ ω)ϕ, where ω = {X i → x i σ}. If the test fails, return 'no'; otherwise continue.4. if all the above tests worked, return 'yes'.Example 5.11. We recall the traces in our running example:T = send(c,enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(dec(x, k), k)].send(c, ok) S 1 = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(a, k)].send(c, ok) S 2 = send(c, enc(a, k)).send(c, enc(a ′ , k)).receive(c, x).[x ? = enc(a ′ , k)].send(c, ok)

  c),receive(c,enc(a,k)),test,send(c) andf 2 = r send(c),send(c),receive(c,enc(a ′ ,k)),test,send(c) .We have k send(c),send(c) (w 1 , enc(a, k)) ∈ H(K) and therefore we have to check, by the first type of test performed by the algorithm, if ({S 1 , S 2 }, ∅) send(c),send(c),receive(c,w1),test,send(c)

Lemma 5 . 7 (

 57 Soundness of canonicalization). If T |= f then T |= f ⇓.

Lemma 5 . 11 (

 511 Soundness of the test saturation rule). Let f, g, h be statements as in the Test saturation rule. If T |= f and T |= g then T |= h.

Theorem 5 . 3 (

 53 Completeness of saturation). Let T and S be traces and let ϕ be a frame such that (T, ∅) L1,...,Ln

Figure 5 . 4 :

 54 Figure 5.4: How to use AKiSs to check (in)equivalence of processes P = {S 1 , . . . , S n } and Q = {T 1 , . . . , T m } which are not known to be determinate.

Figure 5 . 5 :

 55 Figure 5.5: The set Σ(V, v, U, u) of all 24 traces of the FOO e-voting protocol

[

  checksign(adec(y, sk B ), pk(sk A )) ? = ok]. [fst(msg(adec(y, sk B ))) ? = pk(sk A )]. [fst(snd(msg(adec(y, sk B )))) ? = pk(sk B )]. send(c, enc(x, snd(snd(msg(adec(y, sk B ))))))

  send(c),receive(c,w1),test,send(c),send(c)

  ) s.t. (dec(w 2 , w 3 ) ? = h(dec(w 1 , w 3 )))ϕ.

Figure 6 . 1 :

 61 Figure 6.1: Process Algebra

Figure 6 . 2 :

 62 Figure 6.2: Structural Equivalence Rules

Example 6 . 4 .

 64 Continuing our previous example, we had that (R, ∅, ∅) → 5 (send([z] x ), ϕ, σ 0 ), and that R ′′ = ν{z 1 , z 2 }.x b := z 1 .y b := z 2 .R ′ = ν{z 1 , z 2 }.x b := z 1 .y b := z 2 .νx a .νy a .νz b .send({x a } y a ).send(y b ).send([z b ] x b ).

Lemma 6 . 1 .

 61 If E 0 is not trivial then a = E0 b for any distinct atoms a = b.

Claim 6 . 1 .

 61 Let T (a) = P and T (b) = Q. For all 1 ≤ i ≤ l, for all d ∈ {a, b}, for all pure d-terms t ∈ T (F d , (fv (W i ) ∩ Var (T (d))) ∪ N d ∪ M d ), we have that there exist: 1. a pure d-term s i d (t) with Var (s i d

  } and τ i d (x) = {} to conclude. B. otherwise x appears in only one of P = T (a) or Q = T (b). Assume that it only appears in T (e) for e ∈ {a, b}. By Assumption 1, we have that σ(x) = n ∈ N e . We define s i e (x) = σ(x) = n, π i e (x) = {} and τ i e (x) = {} to conclude.

  Let d = domain(f ) and let s = f (z 1 , . . . , z l ) be a pure d-term. Let π = {} and τ = {z i → r i ϕ} 1≤i≤l . By Lemma 6.8, we have thatR ñ a,s (col(ϕ)) = R ñ b,s (col(ϕ)) = R ñ d,s (col(ϕ)). Therefore we can apply Lemma 6.10 to obtain thatR ñ d,s (col(sπτ )) = sR ñ d,s (col(π))R ñ d,s (col(τ )). But π = {} and therefore R ñ d,s (col(sτ )) = sR ñ d,s (col(τ )) which implies R ñ d,s (col(rϕ)) = f (r 1 R ñ d,s (col(ϕ)), . . . , r l R ñ d,s (col(ϕ))) = rR ñ d,s (col(ϕ)). But R ñ d,s (col(rϕ)) = R ñ d,s (col(xσ)) = x d σ ′ and rR ñ d,s (col(ϕ)) = rϕ ′ . Therefore ϕ ′ ⊢ r x d σ ′ ,which is what we had to prove.

  ñ a,s (col(ϕ)) = E R ñ a,s (col(xσ)). But ϕ ′ = R ñ a,s (col(ϕ)) and x d σ ′ = R ñ a,s (col(xσ)) by definition. Therefore rϕ ′ = E x d σ which immediately implies ϕ ′ ⊢ r x d σ ′ , what we had to show. It remains to show that if x, y ∈ Dom(σ) are such that xσ = E yσ and x d , y d ∈ Dom(σ ′ ) for some d ∈ {a, b}, then x d σ ′ = E y d σ ′ . This follows immediately since x d σ ′ = R ñ a,s (col(xσ)) and y d σ ′ = R ñ a,s (col(yσ)) by definition. But R ñ a,s (col(xσ)) = E R ñ a,s (col(yσ)) (from xσ = E yσ by Lemma 6.7), which implies x d σ ′ = E y d σ ′ .

Theorem 6 .

 6 1 is stated for traces. Given an arbitrary process P , we say that Q1 . . . . .Q n is a trace of P if P Q1 ֒→ P 1 Q2 ֒→ . . .Qn֒→ P n where the the transitions § ֒→ are defined in Figure6.5. Intuitively, a process is equivalent to its set of traces.

Theorem 6 . 2 .

 62 Let P = νk 1 . . . . .νk n .(P 1 | P 2 ) be a process over the a-domain and let Q = νk.(x k := k.Q 1 | y k := k.Q 2 ) be a process over the b-domain such that:• P 1 binds x k and P 2 binds y k • fv (P ) = ∅, fv (Q) = ∅ and Var (P ) ∩ Var (Q) = {x k , y k } • P |= Ea Secret(x k ) and P |= Ea Secret(y k ) • Q |= E b Secret(x k ) and Q |= E b Secret(y k ). If Q |= E b Secret(x s ) then W = νk 1 . . . . .νk n .(P 1 .Q 1 | P 2 .Q 2 ) |= E Secret(x s ).

  ν{z a , z b }.(x b k := z a ).(y b k:= z b ).R ′ reveals x a k , y a k , x b k , y b k or x bs in the equational theory E. (We do not know if z a and z b are the same variable). In either case, by Lemma 6.12, we have thatR ′′′ = νk b .(x b k := k b ).(y b k := k b ).R ′ reveals x a k , y a k , x b k , y b k or x b s . But R ′′′ is an interleaving of some trace of P a and Q b . Therefore R ′′′ is a trace of P a | Q b . Therefore P a | Q b reveals x a k , y a k , x b k , y b k or x b s . Assume P a | Q b reveals x a k or y a k . SinceP a and Q b share no data, Q b can be simulated by the adversary and thus P a |= E Secret(z) for some z ∈ {x a k , y a k }. If P a | Q b reveals x b k , y b k or x b s , we similarly deduce that Q b |= E Secret(z) for some z ∈ {x b k , y b k , x b s }. By Corollary 6.1

Theorem 6 . 3 .

 63 Let P = νk 1 . . . . .νk n .!(P 1 | P 2 ) be a process over the a-domain and letQ = !(νk.(x k := k.Q 1 | y k := k.Q 2 )) be a process over the b-domain such that:1. P 1 binds x k and P 2 binds y k 2. fv (P ) = fv (Q) = ∅ 3. P |= Ea Secret(x k ) and P |= Ea Secret(y k ) 4. Q |= E b Secret(x k ) and Q |= E b Secret(y k ) and Q |= E b Secret(x s ) Then R = νk 1 . . . . .νk n .!(P 1 .Q 1 | P 2 .Q 2 ) |= E Secret(x s ).

(

  R, ∅, ∅) §1 -→ (R 1 , ϕ 1 , σ 1 ) §2 -→ . . . §m --→ (R m , ϕ m , σ m ) such that ϕ m ⊢ x s σ m . Let 1 ≤ l ≤ m be the first index such that ϕ l ⊢ x k σ l or ϕ l ⊢ y k σ l or ϕ l ⊢ x s σ l .We can then apply Theorem 6.1 to obtain that the processR ′′ = νz a , z b .(x b k := z a ).(y b k := z b ).R ′ reveals x a k , y a k , x b k , y b k or x bs in the equational theory E. (We do not know if z a and z b are the same variable). In either case, by Lemma 6.12, we have thatR ′′′ = νk b .(x b k := k b ).(y b k := k b ).R ′ reveals x a k , y a k , x b k , y b k or x b s . But R ′′′is an interleaving of some trace of P a and some trace ofQ b . Therefore R ′′′ is a trace of P a | Q b . Therefore P a | Q b reveals x a k , y a k , x b k , y b k or x b s . Assume P a | Q b reveals x a k or y a k .Since P a and Q b share no data, Q b can be simulated by the adversary and thusP a |= E Secret(z) for some z ∈ {x a k , y a k }. If P a | Q b reveals x b k , y b k or x b s , we similarly deduce that Q b |= E Secret(z) for some z ∈ {x b k , y b k , x b s }. By Corollary 6.1, we obtain that P |= Ea Secret(z) for some z ∈ {x k , y k } or that Q |= E b Secret(z) for some z ∈ {x k , y k , x s }. In both cases, this contradicts the hypotheses. We thus deduce that W |= E Secret(x s ).

Example 6 . 6 .

 66 Consider the process P DH defined in Example 6.1, over the signature F DH . Consider any other protocolQ = νy k .(y 1 := y k .Q 1 | y 2 := y k .Q 2 )

  F a enc,h = {enc a , dec a , h a } and F b enc,h = {enc b , dec b , h b }. We consider the associated equational theory E enc = {dec(enc(x, y), y) = x} and the equational theories E a enc = {dec a (enc a (x, y), y) = x} and E b enc = {dec b (enc b (x, y), y) = x}. The signatures F a enc,h and F b enc,h , together with the associated equational theories E a enc and E b enc , can be considered to intuitively model different implementations of the encryption/decryption/hash functions.

For

  every d ∈ {a, b} we consider a tagging function symbol tag d and an untagging function symbol untag d contained in the signature F d = {tag d , untag d } (where both function symbols have arity 1). The role of the tag d function is to tag its argument with the tag d. Typically, this means appending d to the argument but the precise implementation of the tagging function does not need to be specified. The role of the untag d function is to remove the tag. To model this interaction between tag d and untag d we consider the equational theories E d = {untag d (tag d (x)) = x} (for d ∈ {a, b}).

  (a) = 0where a is an atom.The transformation [| |] is extended homomorphically from atomic actions to traces.Example 6.8. Continuing Example 6.7, we have thatH(dec a (x, y)) = untag a (dec(x, y)))and that tests a (untag a (dec(x, y))) = [tag a (untag a (dec(x, y))) = dec(x, y)].[enc(dec(x, y), y) = x]. Finally, we have that [|P a |] = νy.receive(x).[tag a (untag a (dec(x, y))) = dec(x, y)].

Example 6 .

 6 10. ex:hashneedtag We consider the processes P = νx.send(h(x)) and Q = νz.receive(y).[y = h(x)].send(z).

  receive(w1),receive(w2) ----------------→ * to receive(w1),receive(w1)----------------→ *) in order to get the disjoint protocol P.νz ′ .(Q{z → z ′ }) receive(w1),receive(w1)

  These situations are caused by negative tests as illustrated bellow. Consider the following traces:T 1 = send(c, n).send(c, m) T 2 = send(c, n).send(c, n) S = send(c, k).send(c, k),

  • S ¸. Ciobâcȃ. SubVariant, a tool for computing finite, complete sets of variants under optimally reducing convergent equational theories (http://www.lsv.ens-cachan.fr/

	~ciobaca/subvariant)
	• S ¸. Ciobâcȃ. AKiSs, a tool for automatically verifying trace equivalence of determinate,
	bounded security protocols without else branches under convergent term rewriting systems
	having the strong finite variant property (http://www.lsv.ens-cachan.fr/ ~ciobaca/akiss)

  Lemma 3.3 (Partial Completeness). Let t be a term, ω a substitution such that tω is not in normal form, X a set of variables such that Var (t) ⊆ X and P ⊆ Pos(t) a set of positions in t such that tω| p is in normal form for any position p ⊆ Pos(tω) \ P.

	.6)
	By combining Equation (3.3) with Equation (3.6) we obtain that tθ 1 . . . θ n → * R t ′ and by combining Equation (3.4) with Equation (3.5), we obtain that X ′ = X ∪ Var (Range(θ 1 )) ∪ . . . ∪
	Var (Range(θ n )), which is what we had to show.
	Now we describe what completeness means for our narrowing rule:

  that there exists t ′′ , θ, ω ′′ , P ′′ and X ′′ such that (t, P, X) = θω ′′ [X], t ′′ ω ′′ | p is in normal form for all p ∈ Pos(t ′′ ω ′′ ) \ P ′′ and Var (t ′′ ) ⊆ X ′′ . By Lemma 3.1, we have that X ′′ = X ∪ Var (Range(θ)). As Var (t) ⊆ X and ω[X] = θω ′′ [X], we have byLemma 2.1 that tω = tθω ′′ . By Lemma 3.1, we have that tθ → t ′′ . Therefore tθω ′′ → t ′′ ω ′′ , which implies tω → t ′′ ω ′′ .

	ω[X]
	θ ֒→ (t ′′ , P ′′ , X ′′ ),	(3.10)

  Variants(t), a variable renaming π s from Var (sσ s ↓) to some set of variables X s , a variable renaming π t from Var (tσ t ↓) to some set of variables X t such that such that X s ∩ X t = ∅ and a substitution σ = mgu(tuple(sσ s ↓π s , x 1 σ s ↓π s , . . . , x n σ s ↓π s ), tuple(tσ t ↓π t , x 1 σ t ↓π t , . . . , x n σ t ↓π t ))By the choice of σ, we have that x i σ s ↓π s σ = x i σ t ↓π t σ for all variables x i ∈ Var (s)∩Var (t) = {x 1 , . . . , x n } and therefore t ↓π t σ) = R (tσ t )↓π t σ. By choice of σ (it unifies sσ s ↓π s and tσ t ↓π t ) we have that sσ s ↓π s σ = tσ t ↓π t σ.As sω = R sσ s ↓π s σ = tσ t ↓π t σ = R tω, we have that sω = R tω. But R implements E and therefore sω = E tω.3. Σ is complete, i.e. for any substitution τ such that sτ = E tτ , there exist ω ∈ Σ and γ such that τ [Var (s, t)] = E ωγ[Var (s, t)].Let τ be an arbitrary substitution such that sτ = E tτ . As R implements E, we have that sτ ↓ = tτ ↓.

	By using Equation (3.12), we immediately have that ω[Var (t)] = σ t ↓π t σ[Var (t)].
	We have that sω = s(ω[Var (s)]) = s(σ s ↓π s σ) = R (sσ s )↓π s σ. Similarly, tω = t(ω[Var (t)]) =
	t(σ By the definition of a strongly complete set of variants, we have that there exist σ s ∈
	Variants(s) and τ s such that
	sτ ↓ = sσ s ↓τ s	and	τ ↓[Var (s)] = σ s ↓τ s [Var (s)].
	Analogously, there exist σ t ∈ Variants(t) and τ t such that
	tτ ↓ = sσ t ↓τ t	and	τ ↓[Var (t)] = σ t ↓τ t [Var (t)].
	such that ω = σ s ↓π s σ[Var (s) \ Var (t)] ⊎ σ s ↓π s σ[Var (s) ∩ Var (t)] ⊎ σ t ↓π t σ[Var (t) \ Var (s)].
	We trivially have that ω[Var (s)] = σ s ↓π s σ[Var (s)].
	σ s ↓π s σ[Var (s) ∩ Var (t)] = σ t ↓π t σ[Var (s) ∩ Var (t)].	(3.12)

  s k , t 2 , . . . , t n . Thus, we have that |Var (s 1 , . . . , s k , t 2 , . . . , t n )| = |Var (t 1 , . . . , t n )| and u∈{s1,...,s k ,t2,...,tn} |u| <

1≤i≤n |t i |.

  ⇐ tdcommit(t, r, tp), x for every t, r, tp ∈ st ext (ϕ) 13. x ⇐ x, t 1 , . . . , t k for every t 1 , . . . , t k ∈ st ext (ϕ) 14. t ⇐ tdcommit(t 1 , r, tp) for every t, t 1 , r, tp ∈ st ext (ϕ) 15. t ⇐ t 1 , . . . , t k for every t, t 1 , . . . , t k ∈ st ext

1. t ⇐ , for every t ∈ st ext (ϕ); 12. x

  C[t 1 , . . . , t k ] ⇐ Var (C) where: • C is obtained by arbitrarily nesting the following (classes of) contexts: C 1 = enc( , z i ), C 2 = dec( , z i ) and C 3 = pair( , ), where z i are variables. • C contains at least one variable. • C ′ [t 1 , . . . , t k ] ∈ st ext + (φ), where C ′ is obtained from C by replacing enc( , z i ) and dec( , z i ) with . 13. t ⇐ t 1 , . . . , t k , for some t, t 1 , . . . , t k ∈ st ext

	3. snd(x) ⇐ x
	4. enc(x, y) ⇐ x, y
	5. dec(x, y) ⇐ x, y
	6. pair(x, y) ⇐ x, y
	7.

1. t ⇐ ∅ , for some t ∈ st ext + (ϕ) 2. fst(x) ⇐ x 8. x ⇐ pair(x, y) 9. y ⇐ pair(x, y) 10. x ⇐ enc(x, y), y 11. pair(enc(x, z), enc(y, z)) ⇐ pair(x, y), z 12. pair(dec(x, z), dec(y, z)) ⇐ pair(x, y), z + (ϕ) 14. C[t 1 , . . . , t k ] ⇐ s 1 , . . . , s l , Var (C) where:

  ℓi 1 (X 1 , t 1 ), . . . , k ℓ1,...,ℓi n (X n , t n ) is the statement obtained from f ⇓ by replacing the occurnce of recipe R in the head by R ′ .

Example 5.10. If an arbitrary knowledge base is updated by

  not the empty context, then we define domain(C) to be the domain of the topmost element in C. We write C[[s 1 , . . . , s k ]] for the term C[s 1 , . . . , s k ] if C is a pure non-empty context and if domain(C) = domain(s i ) for all 1 ≤ i ≤ k. The terms s 1 , . . . , s k are then called the alien subterms of C[s 1 , . . . , s k ]. Note that in order to write C[[s 1 , . . . , s k ]] for the term C[s 1 , . . . , s k ], C cannot be the empty context. Furthermore, for each term t there is a unique (up to renaming of holes) context C such that t = C[[s 1 , . . . , s k ]] for some terms s 1 , . . . , s k .

  a) if c = d and there exists s i ∈ s such that s = E t = E s i ∈ s, we have by the definition of (t k+l )]. By the definition of C[[t 1 , . . . , t k ]] and D[[t k+1 , . . . , t k+l ]], we have that neither C nor D are the empty context. Therefore t i is a strict subterm of col(s) = C[[t 1 , . . . , t k ]] for all 1 ≤ i ≤ k and that t k+i is a strict subterm of col(t) = D[[t k+1 , . . . , t k+l ]] for all 1 ≤ i ≤ l. Therefore |t i | < |col(s)| for all 1 ≤ i ≤ k and |t k+i | < |col(t)| for all 1 ≤ i ≤ l. By Lemma 6.3, we have that |col(s)| ≤ |s| and |col(t)| ≤ |t|. Therefore |t i | < |s| for all 1 ≤ i ≤ k and |t k+i | < |t| for all 1 ≤ i ≤ l.

	R ñ d,s that R ñ d,s (col(s)) = n d i = R ñ d,s (col(t)) and we are done;
	(b) otherwise, R ñ d,s (col(s)) = R ñ d,s (C[[t 1 , . . . , t k ]]) = C[R ñ c,s (t 1 ), . . . , R ñ c,s (t k )] (by the defini-
	tion of R ñ d,s ) and similarly R ñ d,s (col(t)) = D[R ñ c,s (t k+1 ), . . . , R ñ c,s

2. For the inductive case, if t = f (t 1 , . . . , t l ), we have that t 1 = E col(t 1 ), . . . , t l = E col(t l )) by the induction hypothesis. Therefore t = f (t 1 , . . . , t l ) = E f (col(t 1 )), . . . , col(t l )).

We distinguish two cases:

(a) if col(t) = f (col(t 1 ), . . . , col(t l )) (i.e. the third case of the definition of col) we have already shown that t = E col(t).

(

  n 1 , . . . , n m ] = E n x and as the equational theory E is stable by replacement of names by arbitrary terms, we obtain that C[R ñ c,s (u 1 ), . . . , R ñ c,s (u m

  A ∈ {receive(x), send(t), νx, x := t, s = t} is an atomic process over F d enc,h (with d ∈ {a, b}), we let [|A|] be a trace over F enc,h ∪ F d denoting the d-tagged version of A, defined as follows: d (t) is a sequence of tests which ensure that every decryption and every untagging performed by the protocol is successful:tests d (enc(t 1 , t 2 )) = tests d (t 1 ) • tests d (t 2 ) tests d (h(t 1 )) = tests d (t 1 ) tests d (tag d (t 1 )) = tests d (t 1 ) tests d (dec(t 1 , t 2 )) = [enc(dec(t 1 , t 2 ), t 2 ) = t 1 ]• tests d (t 1 ) • tests d (t 2 ) tests d (untag d (t 1 )) = [tag d (untag d (t 1 )) = t 1 ] • tests d (t 1 ) tests d

	[|receive(x)|] = receive(x)
	[|send(t)|]	= tests d (H(t)) • send(H(t))
	[|νx|]	= νx
	[|x := t|]	= tests

d (H(t)) • x := H(t) [|s = t|] = tests d (H(s)) • tests d (H(t)) • x := H(t)

where H(t) tags the term t with d as defined below:

H(enc d (t 1 , t 2 )) = enc(tag d (H(t 1 )), H(t 2 )) H(dec d (t 1 , t 2 )) = untag d (dec(H(t 1 ), H(t 2 ))) H(h d (t 1 )) = h(tag d (H(t 1 ))) H(a)

= a where a is an atom and where tests

these restrictions on rewrite rules follow the lines of[START_REF] Baader | Term rewriting and all that[END_REF]. Rewrite rules not obeying them are necessarily non-terminating and therefore not very interesting.

Recall that the notation π[X] denotes the restriction of the substitution π to the variables in X.

The work in Chapter 5 of[START_REF] Smyth | Formal verification of cryptographic protocols with automated reasoning[END_REF] also allows automatic verification of FOO by using an add-on to ProVerif called ProSwapper; however the soundness of the add-on itself was never proven and therefore there is not formal guarantee of the result of the verification.

Acknowledgements

advice and encouragements. I would also like to thank Jean Goubault-Larrecq for accepting to be my official advisor and Stéphanie Delaune for co-advising my research thank my friends back home and my family for bearing with me during all this time I was away. Carmen was especially supportive and understanding during the final months of writing up the thesis manuscript.

This thesis was financially supported by the ANR SeSur AVOTE research project (http: //www.lsv.ens-cachan.fr/Projects/anr-avote/).

CONTENTS

Base case: we need to consider two cases according to which rule has been applied.

• Axiom: the rule does not depend on the knowledge base and we trivially conclude.

• Res: we have that n = 0, i.e., (H ⇐) ∈ (K ∪ K 1 )| solved and Hσ = k ℓ1,...,ℓ k (R ′ , t).

As N ames(t) ∩ M 0 = ∅ we have that H ⇐ ∈ K| solved . Hence, (k ℓ1,...,ℓ k (R ′ , t) ⇐) ∈ deriv(K| solved ).

Inductive case: We suppose that the proof ends with an application of the Res rule. We have that H ⇐ B 1 , . . . , B m ∈ (K∪K 1 )| solved , B i σ ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv((K ⊎ K 1 )| solved ) and Hσ = k ℓ1,...,ℓ k (R ′ , t). Let H = k u (S, t ′ ) and B i = k ui (Y i , y i ). As Hσ = k ℓ1,...,ℓ k (R ′ , t) and N ames(t) ∩ M 0 = ∅, by inspection of the statements in K 1 , it must be that H ⇐ B 1 , . . . , B m ∈ K| solved . Moreover, as t ′ σ = t we have by hypothesis that N ames(t ′ σ) ∩ M 0 = ∅ and hence t ′ ∩ N ames(M 0 ) = ∅. As y i ∈ Var (t ′ ) we have that N ames(y i σ) ∩ M 0 = ∅ and we can apply our induction hypothesis to conclude that B i σ ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K| solved ) for 1 ≤ i ≤ n. Hence, as H ⇐ B 1 , . . . , B m ∈ K| solved and B i σ ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n ) ∈ deriv(K| solved ) for 1 ≤ i ≤ n we conclude that (k ℓ1,...,ℓ k (R ′ , t) ⇐ k ℓ1,...,ℓi 1 (X 1 , x 1 ), . . . , k ℓ1,...,ℓi n (X n , x n )) ∈ deriv(K).

The second helper lemma follows.

Lemma 5.5. If K is a knowledge base such that N ames(K) ∩ M 0 = ∅, K 1 ⊆ K names and

Proof. We perform a case distinction depending on which saturation rule triggered:

1. if rule Resolution triggered, we will show that f, g ∈ K.

Indeed, no statement k(m, m) ⇐ ∈ K 1 can play the role of g in the Resolution saturation rule since t ′ = m must unify with t ∈ X. Therefore t must be m, but m ∈ N ames(K) by hypothesis and therefore t cannot be m.

No statement in K 1 can play the role of f in the Resolution saturation rule since they have no antecedents.

Therefore f, g ∈ K and N ames(h) ∈ M 0 . We choose K ′ = K ⊕h, K 2 = K 1 and we conclude by Lemma 5.4.

if rule

Equation triggered, we distinguish three cases:

(a) if a statement k(m, m) ⇐ ∈ K 1 plays the role of f in the Equation saturation rule, we have that t = m. As t ′ unifies with m, we have that either t ′ = m or that t ′ is a variable. The second case is not possible since g must be well-formed. Therefore t ′ = m. As m ∈ N ames(K) by hypothesis it follows that g ∈ K 1 and therefore g = k(m, m). Therefore the resulting statement is i(m, m). We choose K 2 = K 1 ∪ {i(m, m)}, K ′ = K to conclude.

(b) if a statement k(m, m) ⇐ ∈ K 1 plays the role of g, the reasoning is analogous to the case above Lemma 5.8 (Soundness of the consequence). If for all f ∈ K we have that T |= f , then for all f ∈ deriv(K) we have that T |= f .

Proof. We show that both inference rules are sound.

For the Axiom rule, soundness follows immediately from the semantics of k. We now show that each rule of the saturation procedure is sound. with j ≤ i and where σ = mgu(k ℓ ′ 1 ,...,ℓ ′ j (R, t ′ ), k ℓ1,...,ℓj (X, t)). We will show that if T |= f and T |= g then T |= h.

Indeed, let τ be an arbitrary substitution grounding for h and assume that T |= B 1 στ, . . . , B m στ . We will show that T |= Hστ .

As T |= B n+1 στ, . . . , B m στ and because T |= g, we have that T |= k ℓ ′ 1 ,...,ℓ ′ j (R, t ′ )στ . But k ℓ ′ 1 ,...,ℓ ′ j (R, t ′ )στ = k ℓ1,...,ℓj (X, t)στ by choice of σ = mgu(k ℓ ′ 1 ,...,ℓ ′ j (R, t ′ ), k ℓ1,...,ℓj (X, t)). As j ≤ i, it follows by Lemma 5.6 that T |= k ℓ1,...,ℓi (X, t)στ as well. As all antecedents of f στ are true in T and because T |= f , we have that T |= Hστ .

As τ was chosen arbitrarily, it follows that T |= h. Proof. We consider the following statements:

where σ = mgu(k u ( , t), k ′ u ( , t ′ )). We will show that if T |= f and T |= g then T |= h. Let τ be an arbitrary substitution grounding for h. We assume that T |= B 1 στ, . . . , B m στ and we show that

We next show completeness of the intruder identity predicate.

Lemma 5.17. Let K be a saturated knowledge base such that k u (R, t) ∈ H(K| solved ) and k uv (R ′ , t) ∈ H(K| solved ). Then we have that i uv (R, R ′ ) ∈ H(K| solved ).

Proof. Let u = ℓ 1 , . . . , ℓ k and v = ℓ k+1 , . . . , ℓ l . As k u (R, t) ∈ H(K| solved ), it follows by Proposition 5.4 that there exist f = k w (S, s) ⇐ B 1 , . . . , B n ∈ K| solved and a substitution σ grounding for f such that B i σ ∈ H(K| solved ) (1 ≤ i ≤ n) and k w (S, s)σ = k u ′ (R, t) for some u ′ ⊑ u a prefix of u.

Similarly, as k uv (R ′ , t) ∈ H(K| solved ), it follows that there exist

and a substitution σ ′ grounding for f ′ such that B ′ i σ ′ ∈ H(K| solved ) (1 ≤ i ≤ m) and k w ′ (S ′ , s ′ )σ ′ = k u ′′ (R ′ , t) for u ′′ ⊑ uv a prefix of uv.

We have that wσ ⊑ u, which trivially implies wσ ⊑ uv. We also have w ′ σ ′ ⊑ uv. Let w = ℓ ′ 1 , . . . , ℓ ′ p and w ′ = ℓ ′′ 1 , . . . , ℓ ′′ q and let r = min{p, q}. We have that (ℓ ′ 1 , . . . , ℓ ′ r )σ = (ℓ ′′ 1 , . . . , ℓ ′′ r )σ ′ . We have that σ∪σ ′ is a unifier of k ℓ ′ 1 ,...,ℓ ′ r ( , s) and k ℓ ′′ 1 ,...,ℓ ′′ r ( , s ′ ), it follows that the substitution τ = mgu(k ℓ ′ 1 ,...,ℓ ′ r ( , s), k ℓ ′′ 1 ,...,ℓ ′′ r ( , s ′ )) exists. In the following, let l′′′ denote the sequence ℓ ′ 1 , . . . , ℓ ′ p if p ≥ q or the sequence ℓ ′′ 1 , . . . , ℓ ′′ q if p < q. As K is saturated, it follows that the equational fact h = il′′′ (S, S ′ ) ⇐ B 1 , . . . , B n , B ′ 1 , . . . , B ′ m τ ∈ K resulting from applying the Equation saturation rule to f and f ′ is in K.

As σ ∪ σ ′ is a unifier of k ℓ ′ 1 ,...,ℓ ′ r ( , s) and k ℓ ′′ 1 ,...,ℓ ′′ r ( , s ′ ) and as the substitution τ is the most general unifier τ = mgu(k ℓ ′ 1 ,...,ℓ ′ r ( , s), k ℓ ′′ 1 ,...,ℓ ′′ r ( , s ′ )), it follows that there exists ω such that σ∪σ ′ = τ ω.

We have that ω is grounding for h and that B 1 τ ω, . . . , B n τ ω, B ′ 1 τ ω, . . . , B ′ m τ ω ∈ H(K| solved ). Therefore, we have by Lemma 5.13 that

by the ExtendI rule, which is what we wanted to prove.

The next three lemmas show completeness with respect to the intruder knowledge predicate.

Lemma 5.18. Let K be a saturated knowledge base, let

be a statement such that f ⇓ ∈ K| solved and let σ be a substitution grounding for f such that B i σ ∈ H(K| solved ) for all 1 ≤ i ≤ n. Then we have that

Proof. We prove this by induction on the number of canonicalization steps.

If f is already in canonical form, then the conclusion is immediately true by definition of H.

Otherwise, there must be a canonicalization rule which can be applied to f . We distinguish between two cases:

where π ′ = {c i → R i } i∈{1,...,k},ci∈N ames(L1,...,Ln) and π = {c i → t i } i∈{1,...,k},ci∈N ames(L1,...,Ln) .

Proof. By induction on n, the same operational steps will take place with the new labels.

The next lemma shows that deduction is stable by replacement of names with recipes in the recipe and the corresponding deducible terms in the term.

Lemma 5.25. Let T be a trace, let {c 1 , . . . , c k } be public names not appearing in T and let the functions π :

Proof. By induction on R.

We now show that operational semantics is stable by replacement of recipes with equivalent recipes.

Lemma 5.26. Let T be a trace and ϕ a frame such that (T, ϕ)

Then we have that (T, ϕ)

Proof. If M = L then the result is obvious. Otherwise, R and R ′ are recipes for the same term in ϕ and therefore the transition still holds.

We are now ready to prove the correctness of the trace-inclusion checking algorithm: Theorem 5.4. Let T be a trace and let P be a determinate process. Let K be the set of solved statements from a saturated knowledge base associated to T . Then T ⊑ c P iff the following tests hold:

Proof. We first prove that if any of the tests fail, T ⊑ P . Indeed, if the Reachability test fails, we have that (P, ∅) M1,...,Mn ======⇒ ( , ), but, by the soundness of K, we have that (T, ∅) M1,...,Mn ------→ ( , ) and therefore T ⊑ P .

If the Identity test fails, we have that:

some j and where x ranges over all variables in Q j Example 6.2. We consider for the roles of P and Q the processes P 1 and Q 1 in Section 6.3.1:

where {•} • and [•] • denote distinct encryption function symbols. We have that fv (P ) = ∅ and fv (Q) = {x, y}. We also consider the following ground interleaving of P and Q: R = νx.νy.νz.send({x} y ).send(y).send ([z] x ).

We have then that

We consider a run of the composition of P and Q.

where § is receive(r k+1 ) for some recipe r k+1 if the last action was an input and then empty string otherwise. Assume w.l.o.g. that x 1 , . . . , x p ′ are the variables from {x 1 , . . . , x p } which appear in Dom(σ 0 ) and that y 1 , . . . , y q ′ are the variables from {y 1 , . . . , y q } which appear in Dom(σ 0 ). This means that x 1 , . . . , x p ′ , y 1 , . . . , y q ′ are the shared variables that were instantiated before the last action of the execution.

Let {z i } 1≤i≤p ′ and {z i } p+1≤i≤p+q ′ be fresh variables such that

Example 6.3. Continuing the previous example, we consider the run

where

R ′′ corresponds to an interleaving of P and Q where P and Q do not share any variable anymore (since they are duplicated) and where the previously shared variables are instantiated by fresh distinct names. Note that whenever the execution of R instantiates two shared variables by the same value (e.g. x i σ 0 = E x j σ 0 ) then the (duplicated version of) x i and x j are instantiated in R ′′ by the same fresh name. This corresponds e.g. to the case where the same key is distributed among several participants (thus is assigned to distinct variables).

We are now ready to state our main theorem which says that we can mimic on R ′′ the execution trace of R (as in Equation 6.2) unless P or Q do not preserve the secrecy or the freshness of the shared variables. We also have that any subterm of a collapsed term is collapsed:

Proof. By induction on the size of s. We distinguish among the following cases:

As C is not the empty context, we have that s x is a subterm of col(t y ) for some y. We conclude by the induction hypothesis, since any subterm t of col(t y ) (and therefore any subterm t of s x = col(s)) is such that t = col(t).

We also trivially have that first collapsing the direct subterms does not change the final result of collapse. Lemma 6.5. For any function symbol f ∈ F d and for any terms s 1 , . . . , s k we have that col(f (s 1 , . . . , s k )) = col(f (col(s 1 ), . . . , col(s k )).

Proof. Let C, t 1 , . . . , t l be such that f (col(s 1 ), . . . , col(s k )) = C[[t 1 , . . . , t l ]]. By Lemma 6.4 we have that col(col(s i )) = col(s i ) for all 1 ≤ i ≤ k and therefore f (col(col(s 1 )), . . . , col(col

Let n 1 , . . . , n l be fresh names such that n x = n y iff t x = E t y for all 1 ≤ x, y ≤ l. We distinguish two cases:

Furthermore, two terms which are equal modulo E have collapsed forms that enjoy the following property:

where d = domain(C) and n 1 , . . . , n k+l are fresh names such that n i = n j iff s i = E s j for all 1 ≤ i, j ≤ k + l.

The full proof of Lemma 6.6 can be found in Appendix A.1. We extend col to frames as expected:

We next show that R ñ d,s preserves equality modulo E when applied on collapsed terms. Lemma 6.7.

We further distinguish two cases: ֒→ R We can immediately obtain the follows useful lemmas. A process P preserves a secret if and only if all its traces preserve the secret. Lemma 6.11. Let P be a process. Then for any equational theory E, P |= E Secret(x) iff for all Q ∈ T races(P ) we have that Q |= E Secret(x).

Proof. By induction on the number of transitions and case analysis.

One can also notice that if a protocol reveals a secret then it a fortiori reveals it when projecting two names on a single one. Lemma 6.12. For any equational theory

Proof. By induction on the number of transitions in the trace leading to the revelation of x.

We also need to show that, when mounting an attack on a process P over the d-domain (for some d ∈ {a, b}), the adversary is not more powerful when using the combined theory E = E a ∪ E b . This is captured by the following lemma. Lemma 6.13. If P is a trace over the d-domain and

Note that this lemma relies on the assumption we made that E b is not trivial (it does not equate all terms). Otherwise E a ∪ E b would be trivial and therefore all terms would be deducible. The proof of Lemma 6.13 is technical and can be found in Appendix A.2. From the above lemma, we immediately obtain: Corollary 6.1. If P is a process over the d-domain (for some d ∈ {a, b}) and

Key-exchange Protocol

We are now ready to present some applications of Theorem 6.1. Our first application is the composition of a key-exchange protocol with another protocol that relies on the exchanged key.

It is often the case that a security protocol is verified assuming that some keys are already shared between the principals, abstracting away from the process by which these keys have been established. We can use our result to show that if a key exchange protocol was used to establish the key and if the two protocols use disjoint cryptographic primitives, their composition is secure provided that neither the key exchange protocol nor the main protocol reveal the established keys.

To state our result, we first need the following definition:

Composing Tagged Protocols

Our next lemma shows why tagging two protocols is essentially the same as forcing them to use disjoint equational theories. It allows us to reduce the security problem for differently tagged processes to the security problem for processes which use disjoint equational theories. It states that if there is an attack on a composition of two differently tagged protocols

there is an attack on the composition of the same protocols before tagging (P a and Q b ), where the encryption and hash functions come from disjoint equational theories.

Lemma 6.14. Let P and Q be traces over F enc,h . Let W be an arbitrary interleaving of P a and

Furthermore, we have that if a protocol is secure then its c-tagged version is secure.

We can now state a generic theorem, in the spirit of Theorem 6.1, but for tagged protocols.

Let P = P 1 •. . .•P n be a trace over F enc,h with free variables {x 1 , . . . , x p } where P i is an atomic process (1

We consider R ′ a un-tagged copy of R where the shared variables of P and Q are duplicated as in Theorem 6.1 such that P and Q access disjoint variables. More precisely, let

for some j and where x ranges over all variables in P j 2.

for some j and where x ranges over all variables in Q j We consider an execution of the composition of

where § is receive(r k+1 ) for a recipe r k+1 if the last action was an input and the empty string otherwise. Assume w.l.o.g. that x 1 , . . . , x p ′ are the variables from {x 1 , . . . , x p } which appear in Dom(σ 0 ) and that y 1 , . . . , y q ′ are the variables from {y 1 , . . . , y p } which appear in Dom(σ 0 ). This means that x 1 , . . . , x p ′ , y 1 , . . . , y q ′ are the shared variables which were instantiated before the last action of the execution.

Let {z i } 1≤i≤p ′ and {z i } p+1≤i≤p+q ′ be fresh variables such that

Then we have: Theorem 6.4. Assume ϕ 0 ⊢ xσ 0 for any x ∈ {x 1 , . . . , x p ′ , y 1 , . . . , y q ′ } and that x i σ 0 = Eenc∪Ea∪E b y j σ 0 for all x i , y j ∈ Dom(σ 0 ). Then there exist

is a run in the equational theory E enc and such that:

In this tagged setting, the above theorem intuitively states that any trace on the tagged composition of two protocols can be transformed into a trace of the un-tagged composition, but where the two protocols no longer share secrets. Example 6.9. We illustrate the above theorem with an example where the untagged composition of two protocols is not secure. However, using the theorem, we can conclude that the tagged composition is secure.

We consider the processes

previously defined in Section 6.3. We have seen that νx ′ .νy ′ .(x := x ′ ).(y := y ′ ).Q 2 preserves the secrecy of z, while the sequential composition P 1 .Q 2 (where P 1 is used to create the keys x and y) does not preserve the secrecy of z.

However, the sequential composition [|P

] does preserve the secrecy of z by Theorem 6.4.

We can also use Theorem 6.4 to prove tagged variants of Theorem 6.2 and Theorem 6.3: Theorem 6.5 (Tagged version of key-exchange theorem).

) be a process over F enc,h such that:

Appendix A Technical Proofs from Chapter 6

A.1 Proof of Lemma 6.6

This section consists of the proof of Lemma 6.6, which requires several helper lemmas. The proof makes use of techniques developed in [START_REF] Baader | Term rewriting and all that[END_REF]. We first recall the lemma that we are proving.

where d = domain(C) and n 1 , . . . , n k+l are fresh names such that

In Section A.1.1, we introduce several helper concepts, including a ≃ relation between terms which under-approximates = E . In Section A.1.2, we introduce the canonical form of a term, similar to the collapsed form that we have already seen. Section A.1.3 includes a few technical results that we use further on. Section A.1.4 contains the main proof of this Appendix, namely that ≃ is complete with respect to = E in the sense that two terms that are equal modulo E have canonical forms that are in the ≃ relation. Section A.1.5 provides the link between the canonical form and the collapsed form and contains the proof of Lemma 6.6.

A.1.1 Preliminaries

Before proceeding to the proof, we need to define a few concepts.

is a term such that C is a pure d-context and s 1 , . . . , s k are terms with domain(s i ) = d for any 1 ≤ i ≤ k. We extend abstractions to substitutions as expected:

Lemma A.1. For any function symbol f of arity ar(f ) = k and any sequence of terms t 1 , . . . , t k , we have that

Proof. Let C be a pure d-context and let s 1 , . . . , s l be terms with

We distinguish between the two cases above:

, which is what we had to show.

which is what we had to prove.

for any two terms s, t ∈ T (F, A 0 ).

Proof. Let s, t ∈ T (F, A 0 ) be arbitrary terms such that

We will show that

Let C and D be pure d-contexts and s 1 , . . . , s k , s k+1 , . . . , s k+l be terms with domain(s i ) = d (for 1 ≤ i ≤ k+l) such that s = C[s 1 , . . . , s k ] and t = D[s k+1 , . . . , s k+l ].

By definition, we have

By the assumption of ≡ 1 and ≡ 2 , we have that [

As the equational theory E d is stable by replacement of atoms by terms, we have that

which is what we had to prove.

For every n ≥ 0, we let ≃ n to be an equivalence relation on terms defined as follows:

Definition A.3. For two terms s and t, we write s ≃ n t if s and t have the same domain

We first show that two terms which are in the ≃ n relation are equivalent modulo E.

Lemma A.3. For any n ∈ N, for any terms s, t we have that s ≃ n t implies s = E t.

which is what we wanted to prove.

We have that:

Lemma A.4. Let s, t be two terms such that s ≃ n t. Then s ≃ n+1 t.

Proof. By well-founded induction on n. By the induction hypothesis, we have that u ≃ n-1 v implies u ≃ n v for all terms u, v. Therefore by Lemma A.2, we have that

which implies s ≃ n+1 t.

We now define ≃ to be a binary relation between terms:

Definition A.4. We write that s ≃ t if there exists n such that s ≃ n t.

It is easy to see that ≃ is an equivalence relation: symmetry and reflexivity are immediate from the definition of ≃ n and transitivity is easily proved using Lemma A.4.

Lemma A.5. For any terms s, t, we have that s ≃ t implies s = E t.

Proof. Immediate by the definition of ≃ and Lemma A.3.

We now directly characterize when s ≃ t, without going through ≃ n .

Lemma A.6. We have that s ≃ t iff s and t have the same domain

Proof. We prove each implication separately:

1. First assume that s ≃ t. We will show that s and t have the same domain

If follows by the definition of ≃ that there exists an integer n ∈ N such that s ≃ n t. By Lemma A.4 we have that s ≃ n+1 t. By the definition of ≃ n+1 , we have that s and t have the same domain. Let d = domain(s) = domain(t). Furthermore, by the definition of ≃ n+1 , it follows that

[s]

By the definition of ≃, we have that u ≃ n v implies u ≃ v for any two terms u and v. Therefore by Lemma A.2 we have that

which is what we had to show.

2. We now assume that s and t have the same domain d = domain(s) = domain(t) and that

We will show that s ≃ t. Let C and D be pure d-contexts and s 1 , . . . , , s k+l be terms with domain

By the definition of ≃, we have that for any

is therefore well-defined and, as E d is stable by replacement of atoms by terms, we have that

But by the definitions of [s] d ≃n+1 and [t] d ≃n+1 we have

Combined with the fact that domain(f (s 1 , . . . , s k )) = domain(f (t 1 , . . . , t k )) = domain(f ) = d, we obtain by Lemma A.6 that f (s 1 , . . . , s k ) ≃ f (t 1 , . . . , t k ), which is what we had to prove.

A.1.2 Canonical Form

We now introduce the canonical form can(t) of a term t, defined as follows:

Definition A. [START_REF] Abadi | A calculus for cryptographic protocols: The spi calculus[END_REF]. We say that a term t is in canonical form if t = can(t). The difference between the collapsed form of a term and the canonical form is the choice of the fresh names n 1 , . . . , n k in the second and third cases of the definition. In the case of col, two names n i and n j are chosen to be equal (n i = n j ) iff s i = E s j , while in the case of the canonical form n i = n j iff s i ≃ s j . As we will see later, = E and ≃ coincide on canonical forms and therefore the canonical form is identical to the collapsed form. However, this definition of canonical form is required for the proofs. We extend can to substitutions as expected:

We will first show that the canonical form of a term is equal modulo E to the term.

Lemma A.9. For any term t, we have that can(t) = E t.

Proof. By induction on the size of t. We now prove some properties of the canonical form. First of all, any subterm of a canonicalized subterm is canonicalized.

Lemma A.10. Any subterm t ∈ st(can(s)) of can(s) is such that t = can(t).

Proof. By induction on the size of s. We distinguish among the following cases: As C is not the empty context, we have that s x is a subterm of can(t y ) for some y. We conclude by the induction hypothesis, since any subterm t of can(t y ) (and therefore any subterm t of s x = can(s)) is such that t = can(t).

We will now show that canonicalizing the direct subterms of a term does not change the canonical form of the term.

Lemma A.11. For any function symbol f ∈ Σ of arity ar(f ) = k and any terms s 1 , . . . , s k , we have that can(f (s 1 , . . . , s k )) = can(f (can(s 1 ), . . . , can(s k )).

Proof. By the definition of can, 1. either can(f (s 1 , . . . , s k )) = f (can(s 1 ), . . . , can(s k )), in which case f (can(s 1 ), . . . , can(s k )) is a canonicalized term (as it is the same term as can(f (s 1 , . . . , s k ))). Therefore f (can(s 1 ), . . . , can(s k )) = can(f (can(s 1 ), . . . , can(s k ))).

By transitivity of =, we immediately obtain can(f (s 1 , . . . , s k )) = can(f (can(s 1 ), . . . , can(s k ))).

2 which is what we had to prove.

We can now show that canonicalization of any set of subterms of a term does not change the canonical form of the term.

Lemma A.12. For any context C and any terms s 1 , . . . , s k , we have that

Proof. By induction on C:

which is what we had to prove. We immediately obtain as a corollary another way to state the above lemma.

Corollary A.1. For any term s and any substitution σ, we have that can(sσ) = can(s(can(σ))).

Proof. Let C be a context obtained from s by replacing all variables x ∈ Dom(σ) with holes i (1

where Dom(σ) = {x 1 , . . . , x n }. By Lemma A.12, we have that can

. This is equivalent to can(sσ) = can(s(can(σ))), which is what we had to prove.

A.1.3 Abstraction and Canonicalization

We now study the interaction between abstraction and canonical forms. We first need a technical lemma:

Lemma A.13. Let d ∈ {a, b} be a domain and f ∈ F d be a function symbol of arity ar(f ) = k. For any terms s 1 , . . . , s k , we have that

Proof. By the definition of can, we distinguish between two cases:

But as f ∈ F d , we have by Lemma A.1 that

.

By transitivity of =, we obtain that [can(f (s 1 , . . . ,

, which immediately implies the equality modulo E d of the two terms:

On the other hand, we have that

(by definition)

But D[n 1 , . . . , n l ] = E d n i and, as E d is stable by replacement of names by terms, we ob-

From Equation (A.6) and Equation (A.7), we immediately obtain what we had to prove:

Using the above technical lemma, we can now prove:

Lemma A.14. If C is a pure d-context for some d ∈ {a, b, c} and s 1 , . . . , s k are canonicalized terms (i.e.

Proof. By induction on C:

We immediately conclude that they are equal modulo

By the induction hypothesis we have that

We have that

We obtain the following corollary, which is just another way to state the lemma above.

Corollary A.2. If s is a pure d-term for some d ∈ {a, b, c} and σ is a canonicalized substitution (i.e. can(σ) = σ), then

Proof. Let C be a context obtained from s by replacing all variables x ∈ Dom(σ) with holes i (1

Because can(σ) = σ, it follows that x i σ is canonicalized for all 1 ≤ i ≤ n. By Lemma A.14, we then have that

which is what we had to prove.

We now need a lemma to characterize the canonical form of a non-atomic term.

Lemma A.15. Let d be a domain d ∈ {a, b}, let f ∈ F d be a function symbol of arity ar(f ) = k and let t 1 , . . . , t k be terms. Then

where C, s 1 , . . . , s l are such that f (can(t 1 ), . . . , can(t

Proof. We distinguish the two cases:

Let n 1 , . . . , n l be fresh names such that

. As E d is stable by replacement of atoms by terms, we have that

Therefore, by the definition of can, we have that can(f (t 1 , . . . , t k )) = s y for some 1 ≤ y ≤ l such that n x = n y .

But n x = n y implies s x ≃ s y , which concludes what we wanted to show.

Next assume that

We will show that can(f (t 1 , . . . , t k )) = f (can(t 1 ), . . . , can(t k )).

Let n 1 , . . . , n l be fresh names such that n i = n j iff s i ≃ s j for all 1 ≤ i, j ≤ l. We will show by contradiction that

The replacement is well-defined since

Since the equational theory E d is stable by replacement of atoms by terms, we obtain that

But this is false by Equation (A.9). Therefore our assumption was false and we have that

Therefore, by the definition of can, we have that can(f (t 1 , . . . , t k )) = f (can(t 1 ), . . . , can(t k )), which is what we wanted to show.

Lemma A.16. Let s be a term such that can(s

Proof. By the definition of C[[t 1 , . . . , t k ]], C cannot be a hole i for any 1 ≤ i ≤ k. Therefore we distinguish two cases:

for some contexts C 1 , . . . , C l , let t = t 1 , . . . , t k denote the sequence of terms t 1 , . . . , t k . We have that can(s

which is what we wanted to prove.

Lemma A.17. Let d ∈ {a, b, c} be a domain, let C be a pure d-context and let t 1 , . . . , t k be terms in canonical form such that domain(t i ) = d for any

Proof. We will proceed by well-founded induction on C. We distinguish three cases:

We conclude by choosing

We trivially conclude by choosing

We have by the induction hypothesis that there exist pure d-contexts

We then have that

] by the choice of E.

We distinguish two cases:

)) = t y for some 1 ≤ y ≤ k such that t y ≃ t x . If we choose D = y , we immediately obtain our conclusion:

If we choose D = E, we immediately conclude:

Lemma A.18. Let d ∈ {a, b, c} be a domain, let C be a pure d-context and let t 1 , . . . , t k be terms in canonical form such that domain(t i ) = d for any

Proof. By Lemma A.17, we have that there exists a pure

We distinguish between two cases:

We will show by contradiction that D = y is a hole y for some 1 ≤ y ≤ l. Assume by contradiction that D is not such a hole. Then by Lemma A. [START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF] we have that D

] ≃ , which is not the case. Therefore our assumption was false and D = y is a hole for some 1 ≤ y ≤ l.

We have that can(C[t 1 , . . . , t k ]) = D[t 1 , . . . , t k ] = t y ≃ t x , which is what we had to show.

Therefore D cannot be a hole x for some 1 ≤ x ≤ k. This implies domain(

which is what we had to show.

A.1.4 Main Proof

We have now proved all technical results and we are ready to get into the main proof. We show that a rewrite step performed at the top of a term preserves the ≃ relation between the canonical forms.

Lemma A.19. If l ≈ r ∈ E is an identity and σ is a substitution, we have that can(lσ) ≃ can(rσ).

Proof. As l ≈ r ∈ E, we have that there exists d ∈ {a, b} such that l ≈ r ∈ E d .

We have that

We

. Indeed, as l and r a pure dterms, we have by Lemma

We will now show that domain(can(lcan(σ))) = domain(can(rcan(σ))). We distinguish between two cases:

≃ and, by Lemma A.15, can(f (t 1 , . . . , t k )) = u z for some 1 ≤ z ≤ l such that u z ≃ u x . As we already have that can(f (s 1 , . . . , s k )) ≃ u x , we obtain can(f (t 1 , . . . , t k )) ≃ can(f (s 1 , . . . , s k )).

if C[[u

Therefore by Lemma A.15, can(f (t 1 , . . . , t k )) = f (can(t 1 ), . . . , can(t k )).

As we have that can(f (s 1 , . . . , s k )) = f (can(s 1 ), . . . , can(s k )) and also can(f (t 1 , . . . , t k )) = f (can(t 1 ), . . . , can(t k )), we immediately conclude that can(f (s 1 , . . . , s k )) ≃ can(f (t 1 , . . . , t k )).

Proof. We show by induction on C that can(C[can(s)]) ≃ can(C[can(t)]). We distinguish among the following cases:

from where we immediately conclude. Proof. The reverse implication, that can(s) ≃ can(t) implies s = E t, follows by Lemma A.5 and Lemma A.9.

if

For the direct implication, as s = E t, it follows that there exist an integer n ∈ N and terms t 1 , . . . , t n ∈ T (F, A) such that We are now ready to prove the fundamental lemma:

where d = domain(C) and n 1 , . . . , n k+l are fresh names such that n i = n j iff s i = E s j for all 1 ≤ i, j ≤ k + l. . . , n k+l be fresh names such that n x = n y iff s x = E s y for all 1 ≤ x, y ≤ k+l. By Corollary A.4, we obtain that n x = n y iff col(s x ) ≃ col(s y ) for all 1 ≤ x, y ≤ k + l.

As s 1 , . . . , s k+l are subterms of col(s) and col(t), it follows by Lemma 6.4 that col(s i ) = s i for all 1 ≤ i ≤ k + l. Therefore we obtain that n x = n y iff s x ≃ s y for all 1 ≤ x, y ≤ k + l.

As

which is what we wanted to prove.

A.2 Proof of Lemma 6.13

This section consists of the proof of Lemma 6.13. Lemma 6.13. If P is a trace over the d-domain and

Proof. We assume w.l.o.g. that d = a since the case where d = b is analogous. Let init/0 be any constant in F a . The idea is to obtain the second trace from the first trace by abstracting any elements that starts with a symbol from F b by the constant init. This abstraction is formalized by the function abs, which is defined inductively on ground terms as follows:

1. abs(f (t 1 , . . . , t k )) = f (abs(t 1 ), . . . , abs(t

The function abs enjoys the following two properties:

Claim A. Claim A.2. If t is a pure F a term and σ is a collapsed substitution, we have that abs(col(tσ)) = Ea abs(tσ).

Proof. We do the proof by induction on the size of tσ. If t is a variable then col(tσ) = tσ (since we assumed σ to be collapsed) and we are done. Otherwise, root(t) ∈ D a . Let t = f (t 1 , . . . , t k ). We distinguish two cases by the definition of col:

1. either col(tσ) = col(f (t 1 σ, . . . , t k σ)) = f (col(t 1 σ), . . . , col(t k σ)), in which case we can easily conclude by the induction hypothesis We now define σ ′ i and ϕ ′ i (for 1 ≤ i ≤ n). We assume w.l.o.g. that σ i and ϕ i are collapsed (1 ≤ i ≤ n) and let σ ′ i (x) = abs(σ(x)) and ϕ ′ i (w) = abs(ϕ(w)) (for all 1 ≤ i ≤ n, x ∈ Dom(σ i ), w ∈ Dom(ϕ i )).

Definition A.6. We say that a collapsed term t

Ea abs(t j ) and if t j is an i-good term (1 ≤ j ≤ k). It is easy to see that a (i -1)-good term is also an i-good term. We now prove by induction on i that there exist § ′ 1 , . . . , § ′ i such that the recipes in § ′ 1 , . . . , § ′ i are pure F a -recipes and:

→ (P i , ϕ ′ i , σ ′ i ) and that ϕ i (w) and σ i (x) are i-good (for all w ∈ Dom(ϕ i ) and for all x ∈ Dom(σ i )). We proceed with the proof distinguish among the possible actions at step i:

1. if the i-th action is νx, then § i is the empty string. We choose § ′ i also to be the empty string. By the operational semantics, we have that σ i = σ i-1 ∪ {x → n} for some fresh name n. We only need to show that σ i (x) is an i-good term, since the other terms are i-good directly by the induction hypothesis. We consider the context C = n (a context with 0 holes) and k = 0 in the definition of i-good and we can trivially conclude that σ i (x) is i-good.

We also need to establish that the transition works, which is obviously the case, since σ ′ i (x) = abs(σ i (x)) = n.

2. if the i-th action is an assignment x := t, then § i is the empty string. We choose § ′ i also as the empty string.

By the operational semantics, we have that σ i = σ i-1 ∪ {x → col(tσ i-1 )}. As t is a term appearing in the protocol, it is a pure F a -term.

Let C be the context obtained from t by replacing all variables with holes. Then σ i (x) = C[t 1 , . . . , t k ] for some i-good terms t j (1 ≤ j ≤ k) -the terms t j are equal to σ i-1 (y j ) for some y j ∈ Dom(σ i-1 ) (1 ≤ j ≤ k). Let t j = C j [[t j 1 , . . . , t j kj ]]. If C is the empty context we have that σ i (x) = σ i-1 (y) for some y ∈ Dom(σ i-1 ) and therefore we can conclude by the induction hypothesis. We have that tσ i-1 = C ′ [[s 1 , . . . , s l ]] such that s j is an i-good term (each s j (1 ≤ j ≤ l) is either some t j ′ (1 ≤ j ′ ≤ k) which is i-good by the induction hypothesis or some t j ′ z (1 ≤ j ′ ≤ k, 1 ≤ z ≤ k j ′ ) which is i-good because it is an alien term of t j ′ , which is i-good by the induction hypothesis).

Then col(tσ i-1 ) is either equal to some s j (1 ≤ j ≤ l) or to C[s 1 , . . . , s l ]. In the first case, we conclude because we have already seen that all s j (1 ≤ j ≤ l) are i-good. In the second case, we have that root(C) ∈ F a and therefore root(s j ) ∈ F b (1 ≤ j ≤ l). Therefore abs(s j ) = init and it is sufficient to choose r j = init to obtain ϕ ′ i ⊢ rj Ea abs(s j ) (1 ≤ j ≤ l). Furthermore we already know that all s j are i-good and therefore we can conclude that C[s 1 , . . . , s l ] is i-good.

We also need to show that this transition in the conclusion works, i.e. that xσ ′ i = Ea tσ ′ i-1 . We know that col(xσ i ) = E col(tσ i-1 ) (by the hypothesis). We also have that xσ ′ i = abs(xσ i ) and that tσ ′ i-1 = abs(tσ i-1 ). Using Claim A.2 and Claim A.1, we immediately conclude.

3. if the i-th action is a test [s = t], then § i is the empty string. We choose § ′ i also as the empty string.

As ϕ i = ϕ i-1 and σ i = σ i-1 , it is sufficient to show that sσ ′ i-1 = Ea tσ ′ i-1 . But sσ ′ i-1 = abs(sσ i-1 ) and tσ ′ i-1 = abs(tσ i-1 ) by the definition of σ ′ i-1 and abs. By Claim A.2 we have that abs(col(sσ i-1 )) = Ea abs(sσ i-1 ) and analogously for t.

We conclude by Claim A.1 that col(tσ i-1 ) = E col(sσ i-1 ) (which is true by the hypothesis) implies abs(col(tσ i-1 )) = Ea abs(col(sσ i-1 )).

4. if the i-th action is an output send(t), we have that ϕ i = ϕ i-1 ∪ {w |Dom(ϕ)|+1 → col(tσ i-1 )} and that § i is the empty string. We choose § ′ i also as the empty string. We first have to establish that ϕ i (w |Dom(ϕ)|+1 ) = col(tσ i-1 ) is an i-good term, which is exactly the same as in the case of the assignment x := t (see second item above).

We also have to establish that this transition works in the conclusion, i.e. that ϕ ′ i (w |Dom(ϕ)|+1 ) = Ea tσ ′ i-1 knowing that ϕ i (w |Dom(ϕ)|+1 ) = col(tσ i-1 ) (i.e. that the transition works in the hypothesis). We can conclude by Claim A.2 (ϕ ′ i (w |Dom(ϕ)|+1 ) = abs(ϕ i (w |Dom(ϕ)|+1 )) = abs(col(tσ i-1 )) = Ea abs(tσ i-1 ) = tσ ′ i-1 ).

5. if the i-th action is an input receive(x), we have that σ i = σ i-1 ∪ {x → col(rϕ i-1 )} for some recipe r such that § i = receive(r).

We prove by induction on r that col(rϕ i-1 ) is an i-good term and at the same time we construct a pure F a -recipe r ′ such that r ′ ϕ ′ i-1 = Ea abs(rϕ i-1 ). We choose § i to be receive(r ′ ). This means in particular that the transition in the hypothesis will work (xσ ′ i = Ea r ′ ϕ ′ i-1 ). Therefore all we need is the proof of i-goodness and the construction of r ′ by induction.

(a) base case: If r is a parameter w ∈ W, we have that rϕ i-1 is i-good by the induction hypothesis (the outer induction). We choose r ′ = w and we obtain r ′ ϕ ′ i-1 = wϕ ′ i-1 = abs(wϕ i-1 ) = abs(rϕ i-1 ). Each t j (1 ≤ j ≤ k) is such that t j = r j ϕ i-1 for some recipe r j ⊂ r or an alien subterm of ϕ i-1 (w) for some parameter w ∈ Dom(ϕ i-1 ). In the first case we know that t j = col(t j ) is an i-good term by the outer induction hypothesis (t j is an alien subterm of ϕ i-1 (w) for some w ∈ Dom(ϕ i-1 )) and in the second case we that col(t j ) is an i-good term by the inner induction hypothesis. Similarly, there exist pure F a -recipes over ϕ ′ i-1 for abs(col(t j )). Let col(t j ) = C j [[t j 1 , . . . , t j kj ]] and let C ′ j = C j if root(C j ) ∈ F c and let C ′ j = otherwise (1 ≤ j ≤ k). Let C ′ = C[C 1 , . . . , C k ]. As t j j ′ are the alien subterms of an i-good term, it follows that t j j ′ are i-good terms (1 ≤ j ≤ k, 1 ≤ j ′ ≤ k j ) and there exist pure F a -recipes over ϕ ′ i-1 for abs(t j j ′ ). Then rϕ i-1 = C ′ [[s 1 , . . . , s l ]] where each s j (1 ≤ j ≤ l) is either some t j ′ (1 ≤ j ′ ≤ k) or some t j ′ z (1 ≤ j ′ ≤ k, 1 ≤ z ≤ k j ′ ). In either case s j (1 ≤ j ≤ l) are i-good terms and there exist pure F a -recipes over ϕ ′ i-1 for abs(s j ). As col(rϕ i-1 ) is i. either some s j , in which case we conclude directly that it is an i-good term and there is a pure F a -recipe over ϕ ′ i-1 for abs(s j ) ii. or it is C ′ [[s 1 , . . . , s l ]], in which it is also easy to establish that C ′ [[s 1 , . . . , s l ]] is an i-good term (its alien subterms are i-good terms and there are pure F a -recipes over ϕ ′ i-1 for their abstractions). We also need to show that there is a pure F a -recipe over ϕ ′ i-1 for C ′ [[s 1 , . . . , s l ]]. In the case root(C ′ ) ∈ F b , we simply choose the recipe r ′ = init. Otherwise, if root(C ′ ) = root(r) = f ∈ F a and r = f (r 1 , . . . , r m ), we let r ′ = f (r ′ 1 , . . . , r ′ m ). It is then easy to show by induction that r ′ ϕ ′ i-1 = Ea abs(rϕ i-1 ).