(* This program is free software; you can redistribute it and/or      *)
(* modify it under the terms of the GNU Lesser General Public License *)
(* as published by the Free Software Foundation; either version 2.1   *)
(* of the License, or (at your option) any later version.             *)
(*                                                                    *)
(* This program is distributed in the hope that it will be useful,    *)
(* but WITHOUT ANY WARRANTY; without even the implied warranty of     *)
(* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      *)
(* GNU General Public License for more details.                       *)
(*                                                                    *)
(* You should have received a copy of the GNU Lesser General Public   *)
(* License along with this program; if not, write to the Free         *)
(* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *)
(* 02110-1301 USA                                                     *)
(** In this file, we prove properties about hedges. These properties are in section 6.1 of the paper "On Bisimulations for the Spi-Calculus" by J. Borgström and U. Nestmann. However, we consider here an extended message language. *)
(** Author: Sébastien Briais (sebastien.briais@epfl.ch) *)
Unset Standard Proposition Elimination Names.
(** We assume to have a (countably infinite) set of names. *)
Hypothesis Nam : Set.
(** We define three operators for building messages. *)
Inductive op : Set :=
| Pub : op
| Priv : op
| Hash : op.
simple destruct o1; simple destruct o2; try auto;
try (right; red in |- *; intro; inversion H).
Qed.
(** The inversion of an operator. *)
Definition inv_op (o : op) : op :=
match o with
| Pub => Priv
| Priv => Pub
| _ => o
end.
(** A message is either a name, or an encrypted message, or a pair of messages, or an operator applied to a message. *)
Inductive Msg : Set :=
| MNam : Nam -> Msg
| MEnc : Msg -> Msg -> Msg
| MPair : Msg -> Msg -> Msg
| Mop : op -> Msg -> Msg.
(** Inversion of a message. This is to manage public/private keys. *)
Definition inv (M : Msg) : Msg :=
match M with
| Mop op M => Mop (inv_op op) M
| _ => M
end.
simple induction M; simpl in |- *; trivial.
simple destruct o; simpl in |- *; trivial.
Qed.
(** A hedge is a set of pairs of message. *)
Definition hedge := Msg -> Msg -> Prop.
intros.
apply (classic (h M N)).
Qed.
(** g is included in h iff whenever (M,N) is in g then (M,N) is in h *)
Definition inclusion (g h : hedge) := forall M N : Msg, g M N -> h M N.
(** g = h iff g is included in h and h is included in g *)
Definition equal (g h : hedge) := inclusion g h /\ inclusion h g.
unfold inclusion in |- *.
trivial.
Qed.
unfold inclusion in |- *.
intros.
apply H0.
apply H; trivial.
Qed.
unfold equal in |- *.
tauto.
Qed.
unfold equal in |- *.
intro.
split; apply inclusion_refl.
Qed.
unfold equal in |- *.
intros.
elim H.
tauto.
Qed.
unfold equal in |- *.
intros.
elim H.
elim H0.
intros.
split; apply inclusion_trans with g; trivial.
Qed.
(** union and intersection of hedges *)
Definition union (g h : hedge) (M N : Msg) := g M N \/ h M N.
Definition inter (g h : hedge) (M N : Msg) := g M N /\ h M N.
unfold union in |- *.
unfold equal in |- *.
intros.
unfold inclusion in |- *.
tauto.
Qed.
unfold inter in |- *.
unfold equal in |- *.
intros.
unfold inclusion in |- *.
tauto.
Qed.
unfold union in |- *.
unfold inclusion in |- *.
tauto.
Qed.
unfold union in |- *.
unfold inclusion in |- *.
tauto.
Qed.
unfold inter in |- *.
unfold inclusion in |- *.
tauto.
Qed.
unfold inter in |- *.
unfold inclusion in |- *.
tauto.
Qed.
unfold inclusion in |- *.
unfold union in |- *.
intros.
case H1.
apply H.
apply H0.
Qed.
intros.
unfold union in |- *.
unfold inter in |- *.
unfold inclusion in |- *.
tauto.
Qed.
(** The synthesis S(h) of h : it contains all the messages that can be synthetised by the hedge. *)
Inductive synthesis (h : hedge) : hedge :=
| SynInc : forall M N : Msg, h M N -> synthesis h M N
| SynEnc :
forall M N K L : Msg,
synthesis h M N -> synthesis h K L -> synthesis h (MEnc M K) (MEnc N L)
| SynPair :
forall M1 N1 M2 N2 : Msg,
synthesis h M1 N1 ->
synthesis h M2 N2 -> synthesis h (MPair M1 M2) (MPair N1 N2)
| SynOp :
forall (o : op) (M N : Msg),
synthesis h M N -> synthesis h (Mop o M) (Mop o N).
intros.
inversion H.
trivial.
Qed.
intros.
inversion H.
trivial.
Qed.
unfold inclusion in |- *.
intros.
apply SynInc.
trivial.
Qed.
(** g <= h if S(g) is included in S(h) *)
Definition le_h (g h : hedge) := inclusion (synthesis g) (synthesis h).
(** g ~ h if g <= h and h <= g *)
Definition equiv_h (g h : hedge) := le_h g h /\ le_h h g.
unfold le_h in |- *.
intro.
apply inclusion_refl.
Qed.
unfold le_h in |- *.
intros.
apply inclusion_trans with (synthesis g); trivial.
Qed.
unfold equiv_h in |- *.
tauto.
Qed.
unfold equiv_h in |- *.
intro.
split; apply le_h_refl.
Qed.
unfold equiv_h in |- *.
intros.
elim H.
elim H0.
intros.
split; apply le_h_trans with g; trivial.
Qed.
unfold equiv_h in |- *.
tauto.
Qed.
unfold le_h in |- *.
intros.
apply inclusion_trans with (synthesis g); trivial.
apply h_incl_syn.
Qed.
unfold le_h in |- *.
unfold inclusion in |- *.
intros.
induction  H0
as
[M
N
H0|
M
N
K
L
H0_1
HrecH0_1
H0_0
HrecH0_0|
M1
N1
M2
N2
H0_1
HrecH0_1
H0_0
HrecH0_0|
o
M
N
H0
HrecH0].
apply H; trivial.
apply SynEnc; trivial.
apply SynPair; trivial.
apply SynOp; trivial.
Qed.
split.
apply le_h_impl_incl_syn.
apply incl_syn_impl_le_h.
Qed.
intros.
apply incl_syn_impl_le_h.
apply inclusion_trans with h; trivial.
apply h_incl_syn.
Qed.
unfold equal in |- *.
unfold equiv_h in |- *.
intros.
elim H.
intros.
split.
apply inclusion_impl_le_h; trivial.
apply inclusion_impl_le_h; trivial.
Qed.
intros.
apply incl_syn_impl_le_h.
apply union_intro; apply le_h_impl_incl_syn; trivial.
Qed.
intros.
apply le_h_le_h_impl_union_le_h.
apply le_h_trans with h1; trivial.
apply inclusion_impl_le_h; apply hedge_left_union.
apply le_h_trans with h2; trivial.
apply inclusion_impl_le_h; apply hedge_right_union.
Qed.
(** we define how to analyse 'one time' a hedge h: all the pairs are splitted and the encrypted messages are decrypted if the keys are in the synthesis of h *)
Inductive analysis (h : hedge) : hedge :=
| AnaInc : forall M N : Msg, h M N -> analysis h M N
| AnaSplitL :
forall M1 M2 N1 N2 : Msg,
analysis h (MPair M1 M2) (MPair N1 N2) -> analysis h M1 N1
| AnaSplitR :
forall M1 M2 N1 N2 : Msg,
analysis h (MPair M1 M2) (MPair N1 N2) -> analysis h M2 N2
| AnaDec :
forall M N K L : Msg,
analysis h (MEnc M K) (MEnc N L) ->
synthesis h (inv K) (inv L) -> analysis h M N.
intros g h.
unfold inclusion in |- *.
intros.
induction  H0
as
[M N H0| M1 M2 N1 N2 H0 HrecH0| M1 M2 N1 N2 H0 HrecH0| M N K L H0 HrecH0 H1].
apply AnaInc.
apply H; trivial.
apply (AnaSplitL h M1 M2 N1 N2).
trivial.
apply (AnaSplitR h M1 M2 N1 N2).
trivial.
apply (AnaDec h M N K L).
trivial.
generalize (inclusion_impl_le_h g h H).
unfold le_h in |- *.
unfold inclusion in |- *.
intros.
auto.
Qed.
(** We define an infinite sequence (analysis_seq h n) where the n-th term is the n-th analysis of h *)
Fixpoint analysis_seq (h : hedge) (n : nat) {struct n} : hedge :=
match n with
| O => h
| S n => analysis (analysis_seq h n)
end.
simple induction n.
simpl in |- *.
intros.
unfold inclusion in |- *.
intros.
apply AnaInc; trivial.
intros.
simpl in |- *.
unfold inclusion in |- *.
intros.
apply AnaInc.
trivial.
Qed.
simple induction p.
simpl in |- *.
intros.
apply inclusion_refl.
intros.
replace (S n + n0) with (S (n + n0)); try auto with arith.
apply inclusion_trans with (analysis_seq h (n + n0)); trivial.
apply analysis_seq_grow_S.
Qed.
intros.
cut (exists p : nat, m = p + n).
intro.
elim H0.
intro p.
intro.
rewrite H1.
apply analysis_seq_grows.
exists (m - n).
rewrite plus_comm.
apply le_plus_minus.
trivial.
Qed.
(** reduce remove from h all the redundancy: a pair (M,N) is kept in (reduce h) iff it cannot be 'strictly' synthetised by h *)
Definition reduce (h : hedge) (M N : Msg) :=
h M N /\
match M with
| MEnc M' K =>
match N with
| MEnc N' L => ~ synthesis h M' N' \/ ~ synthesis h K L
| _ => True
end
| MPair M1 M2 =>
match N with
| MPair N1 N2 => ~ synthesis h M1 N1 \/ ~ synthesis h M2 N2
| _ => True
end
| Mop opM M' =>
match N with
| Mop opN N' => opM <> opN \/ ~ synthesis h M' N'
| _ => True
end
| _ => True
end.

(** (reduce h) is included in h *)
Lemma red_incl_h : forall h : hedge, inclusion (reduce h) h.