The Hitchhiker’s Guide to Decidability and Complexity of Equivalence Properties in Security Protocols

Abstract

Privacy-preserving security properties in cryptographic protocols are typically modelled by observational equivalences in process calculi such as the applied pi-calulus. We survey decidability and complexity results for the automated verification of such equivalences, casting existing results in a common framework which allows for a precise comparison. This unified view, beyond providing a clearer insight on the current state of the art, allowed us to identify some variations in the statements of the decision problems-sometimes resulting in different complexity results. Additionally, we prove a couple of novel or strengthened results.

DeepSec: Deciding Equivalence Properties for Security Protocols -- Improved theory and practice

“…For this formulation of the problem, generic completeness results w.r.t. complexity classes are not possible in general because different complexities may arise for each rewriting system R. This is for example the case in [AC06], where StatEq is proven PTIME for any fixed subterm convergent rewriting system: the problem is indeed PTIME-hard for some of them [CKR20] but also LOGSPACE for others as we prove it in this paper. All existing procedures [AC06, CDK12, CBC11] are actually exponential in the size of the rewriting system.…”

“…We argue that the latter is more relevant today as the rewriting system can now be specified by the user in many automated tools. This motivated for example to prove in [CKR20] that the complexity results of [Bau07,CCD13] (stated in the parametric setting) were also valid in the general setting.…”

DeepSec: Deciding Equivalence Properties for Security Protocols -- Improved theory and practice

“…For this formulation of the problem, generic completeness results w.r.t. complexity classes are not possible in general because different complexities may arise for each rewriting system R. This is for example the case in [2], where StatEq is proven PTIME for any fixed subterm convergent rewriting system: the problem is indeed PTIME-hard for some of them [34] but also LOGSPACE for others as we prove it in this article. All existing procedures [2,39,42] are actually exponential in the size of the rewriting system.…”

“…We argue that the latter is more relevant today as the rewriting system can now be specified by the user in many automated tools. This motivated for example to prove in [34] that the complexity results of [15,29] (stated in the parametric setting) were also valid in the general setting.…”