The Applied Pi Calculus

Abstract

We study the interaction of the programming construct "new," which generates statically scoped names, with communication via messages on channels. This interaction is crucial in security protocols, which are the main motivating examples for our work; it also appears in other programming-language contexts. We define the applied pi calculus, a simple, general extension of the pi calculus in which values can be formed from names via the application of built-in functions, subject to equations, and be sent as messages. (In contrast, the pure pi calculus lacks built-in functions; its only messages are atomic names.) We develop semantics and proof techniques for this extended language and apply them in reasoning about security protocols. This article essentially subsumes the conference paper that introduced the applied pi calculus in 2001. It fills gaps, incorporates improvements, and further explains and studies the applied pi calculus. Since 2001, the applied pi calculus has been the basis for much further work, described in many research publications and sometimes embodied in useful software, such as the tool ProVerif, which relies on the applied pi calculus to support the specification and automatic analysis of security protocols. Although this article does not aim to be a complete review of the subject, it benefits from that further work and provides better foundations for some of it. In particular, the applied pi calculus has evolved through its implementation in ProVerif, and the present definition reflects that evolution. CCS Concepts: • Security and privacy → Formal methods and theory of security; • Theory of computation → Process calculi;

Context-Free Session Types for Applied Pi-Calculus

“…We consider a "low-level" version of the applied pi-calculus [1] in which composite terms are allowed but only the transmission of simple data is possible: Only names n, constants represented by functions f 0 with arity 0 and functions that evaluate to values of base types can be transmitted. We use the notation M to represent the sequence M 1 , .…”

“…We always assume that our processes are specified relative to a family of parameterized agent definitions that are on the form N( x) def = A and that every agent variable N occurring in a process has a corresponding definition. The formation rules for processes P and extended processes A can be seen below in (1). Note that we distinguish between variables ranged over by x, y .…”

“…In our version of the applied pi-calculus we very directly make use of this. Our semantics consists of reduction semantics and a labelled operational semantics that extend those of [1] with rules for branching and selection. Reductions are of the form P → P ′ , while transitions are of the form P α − → P ′ where the label α is given by…”

“…al. [1]. This is an extension of the pi-calculus [8] with terms and extended processes and in our case extended further with selection and branching.…”

Persistent Stochastic Non-Interference

“…The notion of Non-Interference for deterministic systems has been introduced in [17] and it has been extended to non-deterministic systems. Non-Interference has been then studied in different settings such as programming languages [16,30,31], trace models [22,25], cryptographic protocols [1,6,13], process calculi [7,8,12,19,29], probabilistic models [2,10], timed models [14,18], and stochastic models [2].…”