2020/2021 P. Lafourcade and L. Robert

Security Models

2020/2021 P. Lafourcade and L. Robert

Session 3

Exercise 1

Prove or disprove that a passive Dolev Yao intruder can deduce the following messages with the initial knowledge T ₁ , where {·} _k represents a symmetric encryption scheme with key k.

• T 1 = {hm ₁ , m 2 i, {hm ₁ , m 4 i} _m

, m 4 , {m ₅ } _m

, m 6 , {hm ₄ , m 7 i} _m

, m 7 } and s = {m ₁ } _m

.

• T ₁ = {{a} _k , {c} _a , {k} _{a}

k

} and s = c.

• T ₁ = {hm ₁ , m ₂ i, {hm ₁ , m ₄ i} _m

, m ₄ , {m ₅ } _m

, m ₆ , {hm ₄ , m ₇ i} _m

, m ₇ } and s = m ₃ .

• T 1 = {{m ₁ } _m

, m 2 , {m ₃ } _hm

_,m

_i , {hm ₁ , m 4 i} _hm

_,m

_i } and s = hm ₃ , m 4 i.

Exercise 2

Give the mgu between t and s for the following terms, where x, y, z are variables and a, b constants:

• t = ha, {z} _b i and s = hx, yi

• t = h{x} _b , {y} _b i and s = h{a} _b , zi

• t = {hz, ai} _x and s = {hy, {x} _b i} _b Exercise 3

We define the notion of simple proof: A proof P is simple if each node appears at most once in each branch of P .

Prove that if P is a minimal proof of T ` u then P is a simple proof of T ` u.

Exercise 4

Consider the following protocol:

A → B : h{k ₁ } _k

, mi B → A : {m} _hk

_,k

_i

Assume that k ₂ is a shared key between A and B . Show that k ₁ is secret in presence of passive Dolev-Yao intruder.

1