Unification in monoidal theories

Nutt, Werner

doi:10.1007/3-540-52885-7_118

Cited by 21 publications

(31 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Given a signature Σ, an equational theory E is a set of equations (i.e., a set of unordered pairs of terms in T (Σ, X )). Given two terms u and v such that u, v ∈ T (Σ, N ∪ X ), we write u = E v if the equation u = v is a consequence of E. In this paper, we are particularly interested in the class of group theories, a special case of monoidal theories introduced by F. Baader [6] and W. Nutt [20]. It captures many theories with AC properties, which are known to be difficult to deal with.…”

Section: Group Theoriesmentioning

confidence: 99%

“…It has been shown in [20] that for any group theory E there exists a corresponding ring R E . We can rephrase the definition of R E as follows.…”

Section: Definition 2 (Ring)mentioning

confidence: 99%

“…In particular we consider the case where cryptographic primitives are modelled using a group theory. Group theories are a special case of monoidal theories which have been extensively studied by F. Baader and W. Nutt [20,6] who have provided a complete survey of unification in these theories. Group theories include theories for exclusive or and Abelian groups.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Security Protocols, Constraint Systems, and Group Theories

Delaune

Kremer

Pasailă

2012

Automated Reasoning

View full text Add to dashboard Cite

Section: Group Theoriesmentioning

confidence: 99%

“…It has been shown in [20] that for any group theory E there exists a corresponding ring R E . We can rephrase the definition of R E as follows.…”

Section: Definition 2 (Ring)mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Security Protocols, Constraint Systems, and Group Theories

Delaune

Kremer

Pasailă

2012

Automated Reasoning

View full text Add to dashboard Cite

“…The theory AGnHC is a monoidal theory; further, it is shown in [16,3] that AGnHC is unitary with respect to unification without constants and it is also unitary with respect to unification with constants 2 . In Section 5 of [2], Baader showed that the unification problem of AGnHC reduces to solving linear equations over the polynomial ring Z[h 1 , .…”

Section: Unification Over Equational Theory Of Blinded Signaturesmentioning

confidence: 99%

“…, q n ) be a particular solution for the above set of nonhomogeneous equations obtained, for instance, using Baader's algorithm. From the particular solution, a most general unifier for the unification problem wrt AGnHC is computed (as stated above, AGnHC is unitary for unification without as well as with constants [16,3]). The algorithm is nontrivial; we will not discuss the details here because of space limitations, but suggest the reader to refer to [2] for details.…”

mentioning

confidence: 99%

A Unification Algorithm for Analysis of Protocols with Blinded Signatures

Kapur

Narendran

Wang

2005

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Analysis of authentication cryptographic protocols, particularly finding flaws in them and determining a sequence of actions that an intruder can take to gain access to the information which a given protocol purports not to reveal, has recently received considerable attention. One effective way of detecting flaws is to hypothesize an insecure state and determine whether it is possible to get to that state by a legal sequence of actions permitted by the protocol from some legal initial state which captures the knowledge of the principals and the assumptions made about an intruder's behavior. Relations among encryption and decryption functions as well as properties of number theoretic functions used in encryption and decryption can be specified as rewrite rules. This, for example, is the approach used by the NRL Protocol Analyzer, which uses narrowing to reason about such properties of cryptographic and number-theoretic functions. Following [14], a related approach is proposed here in which equation solving modulo most of these properties of cryptographic and numbertheoretic functions is done by developing new unification algorithms for such theories. A new unification algorithm for an equational theory needed to reason about protocols that use the Diffie-Hellman algorithm is developed. In this theory, multiplication forms an Abelian group; exponentiation function distributes over multiplication, and exponents can commute. This theory is useful for analyzing protocols which use blinded signatures. It is proved that the unification problem over this equational theory can be reduced to the unification problem modulo the theory of Abelian groups with commuting homomorphisms with an additional constraint. Baader's unification algorithm for the theory of Abelian groups with commuting homomorphisms, which reduces the unification problem to solving equations over the polynomial ring over the integers with the commuting homomorphisms serving as indeterminates, is generalized to give a unification algorithm over the theory of Abelian groups with commuting homomorphism with a linear constraint. It is also shown that the unification problem over a (simple) extension of the equational theory considered here (which is also an extension of the equational theory considered in [14]) is undecidable.

show abstract