Deciding Knowledge in Security Protocols Under Equational Theories

Abstract

Abstract. The analysis of security protocols requires precise formulations of the knowledge of protocol participants and attackers. In formal approaches, this knowledge is often treated in terms of message deducibility and indistinguishability relations. In this paper we study the decidability of these two relations. The messages in question may employ functions (encryption, decryption, etc.) axiomatized in an equational theory. Our main positive results say that, for a large and useful class of equational theories, deducibility and indistinguishability are both decidable in polynomial time.

DEEPSEC: Deciding Equivalence Properties in Security Protocols Theory and Practice

“…While many complexity results are known for trace properties [DLM04,RT03], the case of behavioural equivalences remains mostly open. When the attacker is an eavesdropper and cannot interact with the protocol, the indistinguishability problem-static equivalence-has been shown ptime for large classes of cryptographic primitives [AC06,CDK12,CBC10]. For active attackers, bounding the number of protocol sessions is often sufficient to obtain decidability [RT03] and is of practical interest: most real-life attacks indeed only require a small number of sessions.…”

“…This notion has been extensively studied (see e.g. [AC06]). Intuitively, two frames are in static equivalence if an attacker cannot distinguish them, even when applying arbitrary primitives to the messages in the frames.…”

“…In [AC06], it was first shown that for an arbitrary convergent rewriting system R, and signature F the problem Equiv ∼ R,F is undecidable, but for any subterm convergent rewriting system R, Equiv ∼ R,F can be solved in polynomial time. We note that in Equiv R,F , R and F are not part of the input and that all previously proposed procedures in [AC06,CDK12,CBC10] are actually exponential in R or F. Moreover, this definition does not allow to give a lower bound for the whole class of subterm convergent rewriting system (the lower bounds may be different for particular rewriting systems).…”

“…We note that in Equiv R,F , R and F are not part of the input and that all previously proposed procedures in [AC06,CDK12,CBC10] are actually exponential in R or F. Moreover, this definition does not allow to give a lower bound for the whole class of subterm convergent rewriting system (the lower bounds may be different for particular rewriting systems). We therefore define an alternate problem which takes R and F as additional inputs.…”

“…The problem of static equivalence for subterm convergent equational theories has first been studied by [AC06]. It is proven ptime provided that the rewrite system is a constant of the problem.…”