Intruder Deduction for AC-Like Equational Theories with Homomorphisms

Abstract

Abstract. Cryptographic protocols are small programs which involve a high level of concurrency and which are difficult to analyze by hand. The most successful methods to verify such protocols rely on rewriting techniques and automated deduction in order to implement or mimic the process calculus describing the protocol execution. We focus on the intruder deduction problem, that is the vulnerability to passive attacks, in presence of several variants of AC -like axioms (from AC to Abelian groups, including the theory of exclusive or ) and homomorphism which are the most frequent axioms arising in cryptographic protocols. Solutions are known for the cases of exclusive or, of Abelian groups, and of homomorphism alone. In this paper we address the combination of these AC -like theories with the law of homomorphism which leads to much more complex decision problems. We prove decidability of the intruder deduction problem in all cases considered. Our decision procedure is in EXPTIME, except for a restricted case in which we have been able to get a PTIME decision procedure using a property of one-counter and pushdown automata.

Small Vertex Cover makes Petri Net Coverability and Boundedness Easier

“…The following lemma says that if some intermediate marking has very high number of tokens in some place, then a suitable sub-word can be safely transfered without affecting the final marking reached or introducing negative number of tokens in any place, but reducing the maximum number of tokens accumulated in any intermediate marking. The proof is a simple consequence of [16,Lemma 42], which is about one-counter automata. An one-counter automaton is an automaton with a counter that can store natural numbers.…”

“…Apart from changing its state, the automaton can increment the counter, test it for zero and decrement it when not zero. It is proven in [16,Lemma 42] that if a one-counter automaton can reach from one of its configuration to another, it can do so without increasing the intermediate values of the counter by large numbers. A full proof of the following lemma is included in the Appendix for easy reference.…”

“…Precise complexity of reachability and many other problems of this model have been recently obtained in [12,11]. We have adapted some of the techniques used in [12,11], in particular the use of [16,Lemma 42].…”

Hierarchical Combination of Intruder Theories

“…Hence several protocol decision procedures have been designed for handling equational properties [21,11,6,18] of the cryptographic primitives. A very fruitful concept in this area is the notion of locality introduced by McAllester [19] which applies to several intruder theories [12,18].…”

“…A very fruitful concept in this area is the notion of locality introduced by McAllester [19] which applies to several intruder theories [12,18]. When an intruder theory is local then we can restrict every intruder deduction to contain only subterms of its inputs, i.e.…”