Finding Intruder Knowledge with Cap-Matching

Abstract

Given two terms s and t, a substitution $\sigma$ matches s onto t if $s\sigma = t$. We extend the matching problem to handle $\mathbf{Cap }$-terms, which are constructed of function symbols from the signature and a $\mathbf{Cap }$ operator which represents an unbounded number of applications of function symbols from the signature to a set of $\mathbf{Cap }$-terms. A $\mathbf{Cap }$-term represents an infinite number of terms. A $\mathbf{Cap }$-substitution maps variables to $\mathbf{Cap }$-terms and represents an infinite number of term substitutions. $\mathbf{Cap }$ matching is the problem of, given a term s and a $\mathbf{Cap }$-term T, find a set of $\mathbf{Cap }$-substitutions which represents the set of substitutions that matches s onto all the terms t represented by T. We give a sound, complete and terminating algorithm for $\mathbf{Cap }$-matching, which has been implemented in Maude. We show how the $\mathbf{Cap }$-matching problem can be used to find all the messages learnable by an active intruder in a cryptographic protocol, where the $\mathbf{Cap }$ operator represents all the possible functions that can be performed by the intruder.

This work was done with support from NSF grant DMS-1262737 during the summer of 2015.