Using Big-Step and Small-Step Semantics in Maude to Perform Declarative Debugging

Riesco, Adrián

doi:10.1007/978-3-319-07151-0_4

Cited by 6 publications

(3 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several tools and techniques rely on Maude's advanced unification capabilities, such as termination [14] and local confluence and coherence [15,16] proofs, narrowing-based theorem proving [35] or testing [34], and logical model checking [20,4]. The area of cryptographic protocol analysis has also benefited from advanced unification algorithms: Maude-NPA [19], Tamarin [12] and AKISS [5] rely on the different unification features of Maude.…”

Section: Introductionmentioning

confidence: 99%

Variant-based Equational Unification under Constructor Symbols

Aparicio-Sánchez

Escobar

Sapiña

2020

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Equational unification of two terms consists of finding a substitution that, when applied to both terms, makes them equal modulo some equational properties. A narrowing-based equational unification algorithm relying on the concept of the variants of a term is available in the most recent version of Maude, version 3.0, which provides quite sophisticated unification features. A variant of a term t is a pair consisting of a substitution σ and the canonical form of tσ . Variant-based unification is decidable when the equational theory satisfies the finite variant property. However, this unification procedure does not take into account constructor symbols and, thus, may compute many more unifiers than the necessary or may not be able to stop immediately. In this paper, we integrate the notion of constructor symbol into the variant-based unification algorithm. Our experiments on positive and negative unification problems show an impressive speedup.

show abstract

Section: Introductionmentioning

confidence: 99%

Variant-based Equational Unification under Constructor Symbols

Aparicio-Sánchez

Escobar

Sapiña

2020

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

show abstract

“…Several tools and techniques rely on Maude's advanced unification capabilities, such as termination [13] and local confluence and coherence [14] proofs, narrowing-based theorem proving [34] or testing [33], and logical model checking [18,4]. The area of cryptographic protocol analysis has also benefited: the Maude-NPA tool [17] is the most successful example of using variant-based equational unification in Maude and the Tamarin tool [26,10,11] also relies on variants.…”

Section: Introductionmentioning

confidence: 99%

Most General Variant Unifiers

Escobar

Sapiña

2019

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Equational unification of two terms consists of finding a substitution that, when applied to both terms, makes them equal modulo some equational properties. Equational unification is of special relevance to automated deduction, theorem proving, protocol analysis, partial evaluation, model checking, etc. Several algorithms have been developed in the literature for specific equational theories, such as associative-commutative symbols, exclusive-or, Diffie-Hellman, or Abelian Groups. Narrowing was proved to be complete for unification and several cases have been studied where narrowing provides a decidable unification algorithm. A new narrowing-based equational unification algorithm relying on the concept of the variants of a term has been developed and it is available in the most recent version of Maude, version 2.7.1, which provides quite sophisticated unification features. A variant of a term t is a pair consisting of a substitution σ and the canonical form of tσ . Variant-based unification is decidable when the equational theory satisfies the finite variant property. However, it may compute many more unifiers than the necessary and, in this paper, we explore how to strengthen the variantbased unification algorithm implemented in Maude to produce a minimal set of most general variant unifiers. Our experiments suggest that this new adaptation of the variant-based unification is more efficient both in execution time and in the number of computed variant unifiers than the original algorithm available in Maude. We follow the classical notation and terminology from [35] for term rewriting, from [3] for unification, and from [27] for rewriting logic and order-sorted notions.We assume an order-sorted signature Σ = (S, ≤, Σ) with a poset of sorts (S, ≤). The poset (S, ≤) of sorts for Σ is partitioned into equivalence classes, called connected components, by the equivalence relation (≤ ∪ ≥) + . We assume that each connected component [s] has a top element under ≤, denoted [s] and called the top sort of [s]. This involves no real loss of generality, since if [s] lacks a top sort, it can be easily added. We also assume an S-sorted family X = {X s } s∈S of disjoint variable sets with each X s countably infinite. T Σ (X ) s is the set of terms of sort s, and T Σ,s is the set of ground terms of sort s. We write T Σ (X ) and T Σ for the corresponding order-sorted term algebras. Given a term t, Var(t) denotes the set of variables in t.A substitution σ ∈ S ubst(Σ, X ) is a sorted mapping from a finite subset of X to T Σ (X ). Substitutions are written as σ = {X 1 → t 1 , . . . , X n → t n } where the domain of σ is Dom(σ ) = {X 1 , . . . , X n } and the set of variables introduced by terms t 1 , . . . ,t n is written Ran(σ ). The identity substitution is id. Substitutions are homomorphically extended to T Σ (X ). The application of a substitution σ to a term t is denoted by tσ or σ (t). For simplicity, we assume that every substitution is idempotent, i.e., σ satisfies Dom(σ ) ∩ Ran(σ ) = / 0. The restriction of σ to a set of var...

show abstract

“…Several tools and techniques rely on Maude's advanced unification capabilities, such as termination [47] and local confluence and coherence [48,49] proofs, narrowing-based theorem proving [104] or testing [103], and logical model checking [16,58]. The area of cryptographic protocol analysis has also benefited from advanced unification algorithms: Maude-NPA [55], Tamarin [45] and AKISS [17] rely on the different unification features of Maude.…”

Section: Introductionmentioning

confidence: 99%

Modeling and Analysis of Advanced Cryptographic Primitives and Security Protocols in Maude-NPA

Sánchez¹

View full text Add to dashboard Cite

The Maude-NPA crypto tool is a specialized model checker for cryptographic security protocols that take into account the algebraic properties of the cryptosystem. In the literature, additional crypto properties have uncovered weaknesses of security protocols and, in other cases, they are part of the protocol security assumptions in order to function properly. Maude-NPA has a theoretical basis on rewriting logic, equational unification, and narrowing to perform a backwards search from an insecure state pattern to determine whether or not it is reachable. Maude-NPA can be used to reason about a wide range of cryptographic properties, including cancellation of encryption and decryption, Diffie-Hellman exponentiation, exclusive-or, and some approximations of homomorphic encryption.In this thesis, we consider new cryptographic properties, either as part of security protocols or to discover new attacks. We have also modeled different families of security protocols, including Distance Bounding Protocols or Multiparty key agreement protocols. And we have developed new protocol modeling techniques to reduce the time and space analysis effort. This thesis contributes in several ways to the area of cryptographic protocol analysis and many of the contributions of this thesis can be useful for other crypto analysis tools.The Diffie-Hellman key exchange protocol of Section 1.1.3 is the earliest practical example of a public key agreement protocol implemented within the field of cryptography. The Diffie-Hellman key exchange algorithm allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure channel. The protocol is described in Alice & Bob notation as follows where we remark the shared key between participants:A multi-party key establishment can be seen as a generalization of a twoparty key establishment. They are different versions of Diffie-Hellman key agreement that can negotiate a key shared by two or more participants. In the case of three honest participants in an insecure channel, a malicious participant can only see g a , g b , g c ,These honest participants have different options for choosing the order in which they contribute to the key. In the case of four honest participants, the protocol is as follows:In Chapter 3, we specify several three-party key agreement protocols where each protocol creates a shared secret key different from the three-party Diffie-Hellman. The STR protocol uses nested exponentiations. The Joux protocolThis protocol assumes the equational theory DH-CFVP above and its constructor sub-theory DH-SubCFVP. The expression X a computed by Alice is transformed into g a•N using X → g N . The transformed version of the protocol is as follows:where variables X and Y before were of sort Exp and here variables Ny and Nx are of sort ElemSet. In Chapter 3, the cryptography theories of all the analyzed protocols include constructor symbols, all the protocols have been transformed and the variant equations are no longer necessary.

show abstract

Using Big-Step and Small-Step Semantics in Maude to Perform Declarative Debugging

Cited by 6 publications

References 15 publications

Variant-based Equational Unification under Constructor Symbols

Variant-based Equational Unification under Constructor Symbols

Most General Variant Unifiers

Modeling and Analysis of Advanced Cryptographic Primitives and Security Protocols in Maude-NPA

Contact Info

Product

Resources

About