Intruders with Caps

Unification Modulo Homomorphic Encryption

“…We illustrate the technique on a small (NeedhamSchroeder like) 'toy' protocol, assuming the encryption mode to be ECB-based. This paper -which is an enhanced version of [2] -also contains an Appendix, whose aim is to show that the passive deduction problem and unification can have unrelated behaviors, in general-a fact which is in sharp contrast with the case of active deduction, as was already observed in the concluding section of [1], as well as in [12]. We prove this fact here, by showing that unification modulo general -strong rewrite systems is undecidable, by reduction from a suitable version of the Modified Post Correspondence Problem (MPCP).…”

“…A general procedure for protocol security analysis has been given in [5] for such systems, extensively using equational unification and narrowing. Rewrite systems with such a 'subterm property' have been called dwindling in [1], where a decision procedure was given for passive deduction-i.e., detecting secrecy attacks by an intruder not interacting actively with the protocol sessions. The technique used is one that combines unification and narrowing with the notion of cap closure modeling the evolution of the intruder knowledge.…”

“…The technique used is one that combines unification and narrowing with the notion of cap closure modeling the evolution of the intruder knowledge. The algorithm presented in [1] was actually shown to be complete for passive deduction for a class of convergent rewrite systems called -strong, that contains strictly the class of dwindling systems; this class contains in particular the following convergent, non-dwindling system, that we refer to as HE; it extends DY with the requirement that 'encryption distributes over pairs': We shall refer to the equational theory defined by this system HE as Homomorphic Encryption, or again as HE. On protocols where encryption is based on the socalled Electronic Code Book mode (ECB)-i.e., is performed sequentially on a block decomposition of the message -, encryption can be modeled as an homomorphism on pairs.…”

Unification in modal and description logics

“…For example, it can be used in the context of verification of crytographic protocols [23,24,47,27,25,1], where the equational theory models algebraic properties of crytographic functions. In this article, we consider two closely related, yet different application areas for unification: modal logics [19] and description logics [8].…”

Challenges in the Automated Verification of Security Protocols

“…There are actually some works [30,5], answering, at least partly, this question, when A is empty. Many examples however involve associative and commutative symbols.…”