A Proof Theoretic Analysis of Intruder Theories

Abstract

Abstract. We consider the problem of intruder deduction in security protocol analysis: that is, deciding whether a given message M can be deduced from a set of messages Γ under the theory of blind signatures and arbitrary convergent equational theories modulo associativity and commutativity (AC) of certain binary operators. The traditional formulations of intruder deduction are usually given in natural-deduction-like systems and proving decidability requires significant effort in showing that the rules are "local" in some sense. By using the well-known translation between natural deduction and sequent calculus, we recast the intruder deduction problem as proof search in sequent calculus, in which locality is immediate. Using standard proof theoretic methods, such as permutability of rules and cut elimination, we show that the intruder deduction problem can be reduced, in polynomial time, to the elementary deduction problem, which amounts to solving certain equations in the underlying individual equational theories. We show that this result extends to combinations of disjoint AC-convergent theories whereby the decidability of intruder deduction under the combined theory reduces to the decidability of elementary deduction in each constituent theory. Although various researchers have reported similar results for individual cases, our work shows that these results can be obtained using a systematic and uniform methodology based on the sequent calculus. To further demonstrate the utility of the sequent-based approach, we show that, for Dolev-Yao intruders, our sequent-based techniques can be used to solve the more difficult problem of solving deducibility constraints, where the sequents to be deduced may contain gaps (or variables) representing possible messages the intruder may produce. In particular, we show that there is a finite representation of all solutions to such a constraint problem.

Reduction of the Intruder Deduction Problem into Equational Elementary Deduction for Electronic Purse Protocols with Blind Signatures

“…As in [12], some definitions related to terms are necessary, for instance, a term M is said to be an EP-alien term if M is headed by a symbol f / ∈ Σ EP .M is guarded if it is either a name, a variable, or a term headed by a constructor. It is a pure EP-term if it contains only symbols from Σ EP , names and variables.…”

“…The set of inference rules S for the intruder deduction, presented in Table 1 is essentially the same as in [12], except that the (id ) rule considers the equational theory EP and the symbol = AC will be interpreted as equality modulo AC for the operators {+, , •}. Table 1.…”

“…In [12] deductive techniques for dealing with a protocol with blind signatures in which mutually disjoint equational theories containing a unique AC operator each are considered. In that paper the intruder capability of deduction is modeled inside a sequent calculus modulo a rewriting system that models the algebraic deductive power following the approach in [3].…”

“…In this work the techniques in [12] are combined with the ones in [6] in order to model an EPP with blind signatures and it is proved, adapting the techniques in these works, that the intruder deduction problem can be also polynomially reduced to the EDP. Instead combining several disjoint equational theories as in [12], the algebraic power is modeled by a unique equational theory, which has more than one AC operator.…”

“…Instead combining several disjoint equational theories as in [12], the algebraic power is modeled by a unique equational theory, which has more than one AC operator. This is achieved presenting a polynomial algorithm that decides AC equality of the operators used to model the protocol.…”