4 Modelling Using Horn Clauses

(T;Φ;t) ^τ T0(T;Φ;t+δ) δ≥0 ((a,out^z(u)).T;Φ;t) ^{a,out(u )}T0(T{z t};Φ w ^a,t u };t) w∈ W ((a,[u=v]).T;Φ;t) ^a,eqT0(T;Φ;t) u =v ((a,[z:=v].T;Φ;t) ^{a,let(v )}T₀ (T{z v };Φ;t) v ∈R⁺ ((a, t1∼t2 ).T;Φ;t) ^a,test T0(T;Φ;t) t1∼t2

((a,in^z(x)).T;Φ;t) ^a,in(u)T₀(T{x u, z t};Φ;t)

Fig. 2.Semantics of our calculus

received byv at timeδ0. Then, tests performed byv are evaluated successfully, v outputsm, and we reach the configurationK_rapid = (T_rapid;Φ_rapid;δ0) where:

– T_rapid= (v,out^z1(c)).(v,in^z2(y)).(v,[y=h(c, m, γ)]).(v,[[z2−z1<2t0]]), and – Φ_rapid =Φ0 {w4−−→v,δ0 m}.

We can pursue this execution as follows:

K_rapid−−−−−→^v,out(c)T0−→T0

v,in(h(c,m,γ))

−−−−−−−−−→T0

−−→v,eq T0

((v,[[δ0+ 2Dist_T0(v, i)−δ0<2t0]]);Φ_rapid {w5−−→v,δ0 c};δ0+ 2Dist_T0(v, i)) The second arrow is an application of the rule TIM with delay 2Dist_T0(v, i) so that h(c, m, γ) can be received by v at time δ0 + 2Dist_T0(v, i). Since Dist_T0(v, i)< t0, the timing constraint is true and the last action can be executed.

The goal of this paper is to propose a new procedure for analysing a bounded number of sessions of distance bounding protocols. Once the topology is fixed, the existence of an attack can be directly encoded as a reachability property considering a finite set of traces. The following sections are thus dedicated to the study of the following problem:

Input:A traceT locally closed w.r.t.X andZ,t0∈R⁺, and a topologyT0. Output: Do there exist ₁, . . . , _n, Φ, and t such that (T;∅;t₀) −−−−→^1...,n _T0 (;Φ;t)?

((a,out^z(u)).T;φ) ^{a,out(u )} (T;φ {w u}) w∈ W

((a,[u=v]).T;φ) ^a,eq (T;φ) u =v

((a,[z:=v].T;φ) ^a,let(v) (T;φ) ((a, t1∼t2 ).T;φ) ^a,test (T;φ)

((a,in^z(x)).T;φ) ^a,in(u) (T{x u};φ) u=Rφ R

Fig. 3.Relaxed semantics

statements is more in line with what has been implemented in Akiss for optimi- sation purposes rather than what is presented in [12].

4.1 Preliminaries

We consider symbolic runs which are finite sequences of pairs with possibly a run variable typically denotedyat its ends. We have that each pair (a,a) is such that a∈ Aandais an action of the form (withu∈ T(Σ,N ∪R⁺∪ X)):

out(u) in(u) eq test let(u).

Excluding the special variable y, a symbolic run (a₁,a1). . . . .(a_n,an), only contains variables from the set X. We say that it islocally closed if whenever a variable xoccurs in an output action (resp. let action)a_j, then there exists an input actiona_i occurring before (i.e.i < j) such thata_i=a_j and x∈vars(a_i).

Symbolic runs are often denoted w, w, . . ., and we write w w when the sequencewis a prefix ofw. Given a symbolic runw0whose sequence of outputs isout(u1)·. . .·out(u_n), we denoteφ(w0) ={w1→u1, . . . ,w_n →u_n}.

We also consider symbolic recipes which are terms in T(Σ,W ∪ N_pub∪ Y) whereYis a set of recipe variables disjoint fromX andW. We use capital letters X,Y, andZ to range overY.

Example 7. We consider the following symbolic run:

w0= (v,in(aenc(x,sign(x, sk_p),pk(sk_v)))).(v,eq).(v,eq).

(v,out(m)).(v,out(c)).(v,in(h(c, m, x))).(v,eq) We have thatφ(w0) ={w1→m,w2→c}.

Our logic is based on two predicates expressing deduction and reachability without taking into account timing constraints. More formally, given a configura- tion (T;Φ;t), its untimed counterpart is (T;φ) whereφis the untimed counterpart ofΦ, i.e. a frame of the form:φ={w1→u1, . . . ,w_n →u_n}. The relaxed semantics over untimed configurations is given in Fig.3. Since time variables (fromZ) are

not instantiated during a relaxed execution, in an untimed configuration (T;φ), the traceT is only locally closed w.r.t.X. Our predicates are:

– areachability predicate:r_w holds when the runwis executable.

– adeduction predicate:k_w(R, u) holds if the messageucan be built using the recipeR∈ T(Σ,Npub∪R⁺∪ W) by an attacker using the outputs available after the execution ofw (if this execution is possible).

Formally, we have that:

– (T0;φ0)|=r_1,...,n if there exists (T_n;φ_n) such that (T0;φ0) ^1...n (T_n;φ_n) – (T0;φ0)|=k_1,...,n(R, u) if for all (T_n;φ_n) such that (T0;φ0) ^1...n (T_n;φ_n)

we have thatRφ_n↓=u.

This semantics is extended as usual to first-order formulas built using the usual connectives (e.g. conjunction, quantification, ...)

Example 8. The frameφ0 below is the untimed counterpart ofΦ0: φ0={w1→pk(sk_v), w2→sk_i, w3→aenc(γ,sign(γ, sk_p),pk(sk_i))}.

We have that (T_ex;φ0) ^tr (;φ_final) where φ_final is the untimed counterpart ofΦ_final=Φ_rapid {w5−−→v,δ0 c}, and tris the same sequence of labels as the one developed in Example6, i.e.

(v,in(taenc))(v,eq)(v,eq)(v,out(m))(v,out(c))(v,in(h(c, m, γ)))(v,eq)(v,test).

4.2 Seed Statements

We consider particular Horn clauses which we callstatements.

Definition 3. A statement is a Horn clause: H ⇐ k_w1(X1, u1), . . . ,k_wn (X_n, u_n)withH ∈ {r_w0,k_w0(R, u)} and such that:

– w0, . . . , w_n are symbolic runs locally closed,w_iw0 for anyi∈ {1, . . . , n};

– u, u1, . . . , u_n are terms in T(Σ,N ∪R⁺∪ X);

– R∈ T(Σ,Npub∪R⁺∪ W ∪ {X₁, . . . , X_n})Y, andX₁, . . . , X_n are distinct variables fromY.

When H =kw0(R, u), we assume in addition that vars(u) ⊆ vars(u₁, . . . , u_n) andR({X_i→u_i} φ(w₀))↓=u.

In the above definition, we implicitly assume that all variables are universally quantified, i.e., all statements are ground. By abuse of language we sometimes call σ a grounding substitution for a statement H ⇐ (B₁, . . . , B_n) when σ is grounding for each of the atomic formulas H, B₁, . . . , B_n. The skeleton of a statement f, denoted skl(f), is the statement where recipes are removed.

r₁στ ·...·nστ ⇐ {k₁στ ·...·j−1στ (Xj, xjστ )}_j∈Rcv(n)

σ∈csuR({vk=v_k}k∈Eq(n)) τ∈variantsR( 1 nσ)

k₁στ ·...·mστ y(w|Snd(m)|, umστ )⇐ {k₁στ ·...·j−1στ (Xj, xjστ )}j∈Rcv(m)

m∈Snd(n)

σ∈csuR({vk=v_k}k∈Eq(m)) τ∈variantsR( 1 mσ) ky(c, c)⇐

c∈ C

ky(f(Y1, . . . , Yk),f(y1, . . . , yk)τ )⇐ {ky(Yj, yjτ )}j∈{1,...,k}

f∈Σ k

τ∈variantsR(f(y1, . . . , yk))

Fig. 4.Seed statementsseed(T,C)

Our definition of statement is in line with the original one proposed in [12]

but we state an additional invariant used to establish the completeness of our procedure.

In order to define our set of seed statements, we have to fix some naming conventions. Given a traceT of the form (a1,a1).(a2,a2). . . . .(a_n,a_n), we assume w.l.o.g. the following naming conventions:

1. ifa_i is a receive action, thena_i=in^zi(x_i), and_i= (a_i,in(x_i));

2. ifai is a send action, thenai =out^zi(u_i), and_i= (a_i,out(ui));

3. ifai is a test action, thenai = [v_i=v_i], and_i = (a_i,eq);

4. ifai is a let action, thenai= [z_i:=v_i], and _i= (a_i,let(vi)).

5. ifai is a timing constraint thenai= [[t_i∼t_i]], and_i= (a_i,test).

For each m ∈ {0, . . . , n}, the sets Rcv(m), Snd(m), Eq(m), Let(m), and Test(m) respectively denote the set of indexes of the receive, send, equality, let, and test actions amongst a1, . . . ,am. We denote by|S|the cardinality ofS.

Given a setC ⊆ N_pub∪R⁺, the set ofseed statements associated toT andC, denoted seed(T,C), is defined in Fig.4. If C = N_pub∪R⁺, then seed(T,C) is said to be the set of seed statements associated to T and in this case we write seed(T) as a shortcut forseed(T,N_pub∪R⁺). When computing seed statements, we compute complete sets of unifiers and complete sets of variants modulo R.

This allows us to get rid of the rewrite system in the remainder of our procedure and then only consider unification modulo the empty equational theory. In this case, it is well-known that (when it exists) csu_∅(U) is uniquely defined up to some variable renaming, and we writemgu(u1, u2) instead ofcsu_∅({u1=u2}).

Example 9. LetT_ex⁺ =T0·T_ex withT0= (i,out(pk(sk_v))).(i,out(sk_i)).(p,out(u)) andu=aenc(γ,sign(γ, sk_p),pk(sk_i)). The setseed(T_ex⁺,∅) contains among oth- ers the statement f1,f2,f3, andf4 given below:

r_{T0·w0·(v,test)}⇐k_T0(X1,aenc(x,sign(x, sk_p),pk(sk_v))), k_T0·w⁵₀(X2,h(c, m, x));

k_T0·y(w3, u)⇐;

k_y(adec(Y1, Y2),adec(y1, y2))⇐k_y(Y1, y1), k_y(Y2, y2); and its variant ky(adec(Y1, Y2), y3)⇐ky(Y1,aenc(y3,pk(y2))), ky(Y2, y2)

wherew0 is given in Example7, andw⁵₀ is the prefix ofw0 of size 5.

Statementf1expresses that the trace is executable (in the relaxed semantics) as soon as we are able to deduce the two terms requested in input,f₂says that the attacker knows the termuas soon asT₀ has been executed. The two remaining statements model the fact that an attacker can apply the decryption algorithm on any terms he knows (statement f₃), and this will give him access to the plaintext when the right key is used (statementf₄).

4.3 Soundness and Completeness

We now show that as far as the timing constraints are ignored, the set seed(T) is a sound and complete abstraction of a trace. Moreover, we have to ensure that the proof tree witnessing the existence of a given predicate inH(seed(T)) matches with the relaxed execution we have considered. This is mandatory to establish the completeness of our procedure.

Definition 4. Given a setK of statements,H(K)is the smallest set of ground facts such that:

Let B_i =kwi(X_i, u_i)for i∈ {1, . . . , n}, and w₀ the world associated to H with v₁, . . . , v_k the terms occurring in input in w₀. We say that such an instance of Conseq matches with exec = (T;∅) ^1,...,p (S;φ) using R₁, . . . , R_k as input recipes if w0σ1, . . . , _p, and there existRˆ1, . . . ,Rˆ_k such that:

– Rˆ_j({X_i→u_i |1≤i≤n} φ(w0))↓=v_j forj∈ {1, . . . , k}; and – Rˆ_jσ=R_i forj∈ {1, . . . , k}.

This notion of matching is extended to a proof treeπas expected, meaning that all the instances ofConseqused inπsatisfy the property.

Actually, the completeness of our procedure will be established w.r.t. a subset of recipes, namelyuniform recipes. We establish that an execution of a traceT0

which only involves uniform recipes has a counterpart inH(seed(T0)) which is uniform too.

Definition 5. Given a frame φ, a recipe R is uniform w.r.t. φ if for any R1, R2∈st(R)such that R1φ↓=R2φ↓, we have thatR1=R2.

Given a setK of statements, we say that a set{π1, . . . , π_n} of proof trees in H(K)is uniform if for any k_w(R1, t)and k_w(R2, t) that occur in{π1, . . . , π_n}, we have thatR1=R2.

We are now able to state our soundness and completeness result.

Theorem 1. Let T0 be a trace locally closed w.r.t.X. – (T₀;∅)|=g for anyg∈seed(T₀)∪ H(seed(T₀));

– Ifexec= (T0;∅) ^1,...,p (S;φ)with input recipesR1, . . . , R_k that are uniform w.r.t.φthen

1. r1,...,p∈ H(seed(T₀)); and

2. if Rφ↓ = u for some recipe R uniform w.r.t. φ then k1,...,p(R, u) ∈ H(seed(T0)).

Moreover, we may assume that the proof tree witnessing these facts are uni- form and match withexecusing R1, . . . , R_k as input recipes.