Folding variant narrowing and optimal variant termination

Abstract

If a set of equations E∪Ax is such that E is confluent, terminating , and coherent modulo Ax, narrowing with E modulo Ax provides a complete E ∪Ax-unification algorithm. However, except for the hopelessly inefficient case of full narrowing, nothing seems to be known about effective narrowing strategies in the general modulo case beyond the quite depressing observation that basic narrowing is incomplete modulo AC. In this work we propose an effective strategy based on the idea of the E ∪ Ax-variants of a term that we call folding variant narrowing. This strategy is complete, both for computing E ∪ Ax-unifiers and for computing a minimal complete set of variants for any input term. And it is optimally variant terminating in the sense of terminating for an input term t iff t has a finite, complete set of variants. The applications of folding variant narrowing go beyond providing a complete E ∪ Ax-unification algorithm: computing the E ∪Ax-variants of a term may be just as important as computing E ∪Ax-unifiers in recent applications of folding variant narrowing such as termination methods modulo axioms, and checking confluence and coherence of rules modulo axioms.

Twenty years of rewriting logic

“…Using the idea of variants 8 of a term proposed by Comon-Lundth and Delaune in [121], Escobar, Sasse and I have defined a complete narrowing strategy with equations E modulo B called folding variant narrowing 9 [189] (see also the longer paper [190] in this issue), that is optimally terminating, that is, if any complete narrowing strategy terminates on an input term, then folding variant narrowing will terminate on that term. Furthermore, if E ∪ B has the so-called finite variant property [121], folding variant narrowing will terminate on all input terms.…”

“…To the best of my knowledge the Maude-NPA is the most advanced analysis tool to date for analyzing cryptographic protocols modulo algebraic properties with an active intruder and an unbounded number of sessions in a complete way and without using any abstractions or approximations. For many protocols, Maude-NPA can exploit the fact that E ∪ B happens to enjoy the finite variant property to obtain a finitary E ∪ B-unification algorithm by variant narrowing (see [190] and Section 3.3). But finitary algorithms for theories E ∪ B not having the finite variant property, e.g., homomorphic encryption, are also supported by Maude-NPA.…”

Protocol analysis in Maude-NPA using unification modulo homomorphic encryption

“…However, narrowing modulo AC doesn't terminate for many theories of interest to cryptographic protocol analysis, including exclusive-or and Abelian groups. Comon and Delaune [17] have identified a property known as the finite variant property which is checkable under appropriate conditions [23]. Although for many theories E = Δ ∪ AC narrowing modulo AC does not terminate, The folding variant narrowing strategy [23] computes a finite complete set of E-unifiers whenever E has the finite variant property.…”

“…It makes use of equational unification to meet its goals. The approach of Maude-NPA up to this point has been to make use of folding variant narrowing [23] to perform equational unification. Suppose that the operators used in the protocol obey an equational theory EP .…”

“…Suppose that the operators used in the protocol obey an equational theory EP . To do this, we divide the equational theory EP describing the algebraic properties obeyed by the cryptosystem into Δ ∪ Ax, where Δ is a set of rewrite rules and Ax is a set of axioms such that Δ has the finite variant property modulo Ax [17,23]. In that case, it is possible to apply a version of narrowing modulo Ax called folding variant narrowing to compute EP unifiers.…”