# Methodology of Testing the Security of Cryptographic Protocols Using the CMMTree Framework
## 4 Description of the Methodology
### Properties and Functionalities of the CMMTree Model  
In this section, we would like to present in the shortest possible way what CMMTree is, that is, an original solution; it has already been described in more detail in [14]. Although we are aware that some of the information presented here will repeat what is written in [14], we have decided that in the context of the entire work, a brief description of this solution is necessary. This is because CMMTree is a general tool designed to build and analyze multi-way conditional trees, and its key component is the predicate function, which can be formulated in many ways--better or worse--as we will try to show in the following sections. We deliberately decided to use many of the same symbols or phrases (as in [14]) so that a person who wants more details about CMMTree can quickly find them in [14]. In general, the CMMTree logic model is described by:  
\[\textbf{CMMTree}=(\textbf{D},p,\textbf{T}) \tag{1}\]  
where:  
\(\textbf{D}=\{d_{1},...,d_{x}\}\) is a collection of a unique input data values;  
\(\textbf{T}=\{v_{i}:0\leq i<n\}\) is the tree structure of relationships between input data;  
\(p:\textbf{D}^{k}\times\textbf{T}\rightarrow\{true,false\},(k=1,...,x)\) is a predicate that defines the rules for joining **T** nodes. In this model, three layers are clearly distinguished (see Figure 1): the data layer, predicate layer, and relationship layer. The elements of the input dataset **D** should be unique; however, their representations (references to individual values) may occur multiple times in the **T** structure. For example, in Figure 1, node \(v_{1}\) represent the value \(d_{1}\), node \(v_{2}\) the value \(d_{2}\), and so on. The processed data are not required to be exactly the same type, and they can generally be of different types as long as they belong to a defined class hierarchy. A vector of pointers to them can easily represent such a set of data--see Figure 1. In the present case of the study of cryptographic protocols, the input data were a set of chain objects, described in Section 4.2. Figure 1: The logical structure of the CMMTree model. The rules for joining subsequent nodes of the tree **T** are defined in a two-argument predicate function \(p\):  
\[p(\alpha,\beta)= \begin{cases}true&\text{if defined conditions are met}\\ false&\text{otherwise}\end{cases}  \tag{2}\]  
where:  
\(\alpha\) represents the current node and the set of information available through this node;  
\(\beta\) represents the successive elements of the set **D** (candidates to be the \(\alpha\) node child). Each decision on whether another node can be attached is made based on the information accumulated so far in tree **T** and the information provided by candidate \(\beta\). The amount and scope of information taken from the tree can be varied. Data can be extracted from a single node, nodes on a path, as well as any other combination of nodes. Moreover, if the analyzed data form a class hierarchy, then information about the type of an object or group of objects can also be used by the predicate function \(p\) and (if necessary) will be able to operate polymorphically at run-time. The predicate function \(p\) (PF) must always be defined. As said before, the situation in which it returns a true value may depend on the required or already existing structure of the relationship between the data. In the simplest variant, \(p\) can always return false, but in this scenario, tree **T** will consist of only the root node. Such an implementation of the \(p\) function, although not interesting from a practical point of view, is very helpful in the process of code development and testing. There are many ways to implement multi-way trees, and some of the most commonly used include _left-child/right-sibling_[43; 44; 45; 46] (also known as _first_child/next_sibling_[47]), _array of pointers_[44], and _dynamic array-based list of child pointers_[45]. In CMMTree, however, a different solution was used. All nodes of tree **T** are free-stored objects, allocated on the heap.