Unification and matching modulo nilpotence

Guo, Qing; Narendran, Paliath; Wolfram, D. A.

doi:10.1007/3-540-61511-3_90

Cited by 10 publications

(13 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Proof. NP-hardness follows from the fact that general unification modulo XOR is NPcomplete [12]. We deduce the NP-upper bound from the following facts: a) For any given BC-unification problem, computing a standard form is in polynomial time, wrt the size of the problem.…”

Section: Bc 1 -Unification Is Np-completementioning

confidence: 99%

Unification modulo a 2-sorted Equational theory for Cipher-Decipher Block Chaining

Anantharaman¹,

Bouchard²,

Narendran³

et al. 2014

Logical Methods in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. We investigate unification problems related to the Cipher Block Chaining (CBC) mode of encryption. We first model chaining in terms of a simple, convergent, rewrite system over a signature with two disjoint sorts: list and element. By interpreting a particular symbol of this signature suitably, the rewrite system can model several practical situations of interest. An inference procedure is presented for deciding the unification problem modulo this rewrite system. The procedure is modular in the following sense: any given problem is handled by a system of 'list-inferences', and the set of equations thus derived between the element-terms of the problem is then handed over to any ('black-box') procedure which is complete for solving these element-equations. An example of application of this unification procedure is given, as attack detection on a Needham-Schroeder like protocol, employing the CBC encryption mode based on the associative-commutative (AC) operator XOR. The 2-sorted convergent rewrite system is then extended into one that fully captures a block chaining encryption-decryption mode at an abstract level, using no AC-symbols; and unification modulo this extended system is also shown to be decidable.

show abstract

Section: Bc 1 -Unification Is Np-completementioning

confidence: 99%

Unification modulo a 2-sorted Equational theory for Cipher-Decipher Block Chaining

Anantharaman¹,

Bouchard²,

Narendran³

et al. 2014

Logical Methods in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…This equational theory is relevant because none of our previously defined unification procedures is directly applicable to it, e.g. unification algorithms for exclusive-or such as [22] do not directly apply if extra equations are added. For (Σ, Ax, E) a decomposition of XOR ∪ pk-sk, and for terms t = M ⊕sk(K, pk(K, M )) and s = X⊕sk(K, pk(K, Y )), we have that [[t]] E,Ax = {(0, id), .…”

Section: Definition 2 (Variant Semanticsmentioning

confidence: 99%

Protocol Analysis Modulo Combination of Theories: A Case Study in Maude-NPA

Sasse

Escobar

Meadows

et al. 2011

Security and Trust Management

View full text Add to dashboard Cite

Abstract. There is a growing interest in formal methods and tools to analyze cryptographic protocols modulo algebraic properties of their underlying cryptographic functions. It is well-known that an intruder who uses algebraic equivalences of such functions can mount attacks that would be impossible if the cryptographic functions did not satisfy such equivalences. In practice, however, protocols use a collection of wellknown functions, whose algebraic properties can naturally be grouped together as a union of theories E1∪. . .∪En. Reasoning symbolically modulo the algebraic properties E1 ∪ . . . ∪ En requires performing (E1 ∪ . . . ∪ En)-unification. However, even if a unification algorithm for each individual Ei is available, this requires combining the existing algorithms by methods that are highly non-deterministic and have high computational cost. In this work we present an alternative method to obtain unification algorithms for combined theories based on variant narrowing. Although variant narrowing is less efficient at the level of a single theory Ei, it does not use any costly combination method. Furthermore, it does not require that each Ei has a dedicated unification algorithm in a tool implementation. We illustrate the use of this method in the Maude-NPA tool by means of a well-known protocol requiring the combination of three distinct equational theories.

show abstract

“…Efficient unification algorithms have been developed for elementary AGH-unification [5,6]. However, cryptographic protocol analysis also must deal with uninterpreted function symbols.…”

Section: Introductionmentioning

confidence: 99%

Efficient general AGH-unification

Liu

Lynch

2014

Information and Computation

View full text Add to dashboard Cite

General E-unification is an important tool in cryptographic protocol analysis, where the equational theory E represents properties of the cryptographic algorithm, and uninterpreted function symbols represent other functions. The property of a homomorphism over an Abelian group is common in encryption algorithms such as RSA. The general E-unification problem in this theory is NP-complete, and existing algorithms are highly nondeterministic. We give a mostly deterministic set of inference rules for solving general E-unification modulo a homomorphism over an Abelian group, and prove that it is sound, complete and terminating. These inference rules have been implemented in Maude, and will be incorporated into the Maude-NRL Protocol Analyzer (Maude-NPA).

show abstract

Unification and matching modulo nilpotence

Cited by 10 publications

References 7 publications

Unification modulo a 2-sorted Equational theory for Cipher-Decipher Block Chaining

Unification modulo a 2-sorted Equational theory for Cipher-Decipher Block Chaining

Protocol Analysis Modulo Combination of Theories: A Case Study in Maude-NPA

Efficient general AGH-unification

Contact Info

Product

Resources

About