[Paper Review] Satisfiability of General Intruder Constraints with and without a Set Constructor

Tigran Avanesov, Yannick Chevalier+2 more|Open Archive Toulouse Archive Ouverte (University of Toulouse)|Mar 1, 2011

Advanced Authentication Protocols Security2 references4 citations

TL;DR

This paper presents an NP-complete decision procedure for solving general intruder constraints in the Dolev-Yao model, extending prior work by supporting non-atomic keys and an associative, commutative, and idempotent (ACI) operator for modeling sets. The method enables secure protocol analysis under relaxed assumptions, including multiple non-communicating intruders and algebraic properties, while maintaining decidability where it previously failed for subterm-convergent theories.

ABSTRACT

Many decision problems on security protocols can be reduced to solving so-called intruder constraints in Dolev Yao model. Most constraint solving procedures for protocol security rely on two properties of constraint systems called monotonicity and variable origination. In this work we relax these restrictions by giving a decision procedure for solving general intruder constraints (that do not have these properties) that stays in NP. Our result extends a first work by L. Mazaré in several directions: we allow non-atomic keys, and an associative, commutative and idempotent symbol (for modeling sets). We also discuss several new applications of the results.

Motivation & Objective

• To address the limitations of existing constraint-solving techniques in the Dolev-Yao model, which rely on restrictive assumptions like knowledge monotonicity and variable origination.
• To extend decidability results to general intruder constraints that do not satisfy these assumptions, particularly in the presence of algebraic properties such as ACI (associative, commutative, idempotent) operators.
• To support the modeling of sets in cryptographic protocols using an ACI operator, enabling analysis of XML-based or structured data protocols.
• To demonstrate that satisfiability remains decidable for general constraints with ACI operators, while undecidability arises for subterm-convergent theories.
• To provide a foundation for analyzing complex security protocols involving multiple non-communicating intruders and algebraic data structures.

Proposed method

• The authors introduce a normalized model construction via a conservative model transformation, ensuring that all variable assignments are minimal and consistent with the constraint system.
• They define a closure operation using a homomorphism π and a derivation function Der to simulate intruder knowledge progression under the Dolev-Yao deduction system with ACI theory.
• A key technique involves the use of a quotient-based substitution θ that partitions variable domains according to equivalence classes under a model σ′, enabling the construction of a normalized model σ = δ[θ].
• The size of DAG representations of terms in the model is bounded by twice the size of the input constraint system, ensuring polynomial space complexity.
• The procedure leverages Propositions 1–3, Lemma 2, and Corollary 1 to prove that any model of a constraint system can be transformed into a normalized, conservative model with bounded term complexity.
• The method is proven correct through a chain of logical implications, including the use of closure under derivability and the preservation of satisfiability under model transformations.

Experimental results

Research questions

• RQ1 Can satisfiability of general intruder constraints be decided in NP when relaxing the monotonicity and variable-origination assumptions in the Dolev-Yao model?
• RQ2 Does the inclusion of non-atomic keys and an ACI operator (for modeling sets) preserve decidability in the general constraint framework?
• RQ3 Is the satisfiability problem still decidable for general constraints when using an ACI operator, despite undecidability in more complex subterm-convergent theories?
• RQ4 Can the decision procedure be extended to support multiple non-communicating intruders in protocol analysis?
• RQ5 What are the theoretical limits of extending constraint-solving techniques beyond well-formed constraints, particularly in terms of undecidability?

Key findings

• The satisfiability of general intruder constraints with non-atomic keys and an ACI operator is decidable in NP, extending prior results that required well-formed constraints.
• The paper proves that satisfiability becomes undecidable when extending the framework to subterm-convergent theories, even though it remains decidable for well-formed constraints.
• A normalized model δ[θ] is constructed such that the size of each term’s DAG representation is bounded by twice the size of the input constraint system, ensuring polynomial space complexity.
• The decision procedure supports modeling of sets in protocols via an ACI operator, enabling analysis of XML-based or structured data exchanges.
• The method allows for the analysis of protocols with multiple non-communicating intruders, a scenario not supported by standard well-formed constraint solvers.
• The construction of a conservative model ensures that satisfiability is preserved under transformation, enabling sound and complete reasoning over complex constraint systems.