We present a new technique for verifying correspondences in security protocols. In particular, correspondences can be used to formalize authentication. Our technique is fully automatic, it can handle an unbounded number of sessions of the protocol, and it is efficient in practice. It significantly extends a previous technique for the verification of secrecy. The protocol is represented in an extension of the pi calculus with fairly arbitrary cryptographic primitives. This protocol representation includes the specification of the correspondence to be verified, but no other annotation. This representation is then translated into an abstract representation by Horn clauses, which is used to prove the desired correspondence. Our technique has been proved correct and implemented. We have tested it on various protocols from the literature. The experimental results show that these protocols can be verified by our technique in less than 1 s. * This paper is an updated and extended version of [13] and [14].We mainly focus on the works that automatically verify correspondences and authentication for security protocols, without bounding the number of sessions.The NRL protocol analyzer [43,58], based on narrowing in rewriting systems, can verify correspondences defined in a rich language of logical formulae [70]. It is sound and complete, but does not always terminate. Our Horn clause representation is more abstract than the representation of NRL, which should enable us to terminate more often and be more efficient, while remaining precise enough to prove most desired properties.Gordon and Jeffrey designed a system named Cryptic for verifying authentication by typing in security protocols [47][48][49]. They handle shared-key and public-key cryptography. Our system allows more general cryptographic primitives (including hash functions and Diffie-Hellman key agreements). Moreover, in our system, no annotation is needed, whereas, in Cryptic, explicit type casts and checks have to be manually added. However, Cryptic has the advantage that type checking always terminates, whereas, in some rare cases, our analyzer does not.Bugliesi et al.[26] define another type system for proving authentication in security protocols. The main advantage of their system is that it is compositional: it allows one to prove independently the correctness of the code of each role of the protocol. However, the form of messages is restricted to certain tagged terms. This approach is compared with Cryptic in [25].Backes et al.[10] prove secrecy and authentication for security protocols, using an abstract-interpretation-based analysis. This analysis builds a causal graph, which captures the causality among program events; the security properties are proved by traversing this graph. This analysis can handle an unbounded number of sessions of the protocol; it always terminates, at the cost of additional abstractions, which may cause false attacks. It handles shared-key and public-key cryptography, but not Diffie-Hellman key agreements. It assumes that the mess...