💻 computer science

Knowledge Problems in Protocol Analysis: Extending the Notion of Subterm Convergent

This paper introduces graph-embedded term rewrite systems to extend the scope of decidable knowledge problems in security protocol analysis by proving decidability for the contracting convergent subclass while demonstrating undecidability for the broader class, alongside providing combination results with other equational theories.

Original authors: Carter Bunch, Saraid Dwyer Satterfield, Serdar Erbatur, Andrew M. Marshall, Christophe Ringeissen

Published 2026-04-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Carter Bunch, Saraid Dwyer Satterfield, Serdar Erbatur, Andrew M. Marshall, Christophe Ringeissen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The Security Protocol Detective

Imagine you are a detective trying to solve a mystery involving a secret message. In the world of computer security, this "mystery" is a security protocol (like a digital handshake between a bank and a customer). The "detective" is a hacker (or an automated tool) trying to figure out what information they can steal or fake.

To do this, the detective uses a set of rules (mathematical equations) that describe how the protocol works. For example, a rule might say: "If you have a locked box and the key, you can open it to get the message inside."

The paper asks two main questions about these rules:

Deduction: Can the detective figure out a specific secret (like a password) using the rules and the information they already have?
Static Equivalence: Can the detective tell the difference between two different scenarios? (e.g., "Is this encrypted message actually about Alice, or is it just a random string that looks like it's about Alice?")

The Old Problem: The "Strict Subterm" Rule

For a long time, computer scientists had a very strict rule for when they could easily answer these questions. They called it Subterm Convergent.

The Analogy: Imagine a Russian Nesting Doll.

The Rule: To open the doll, you must be able to take it apart and find a smaller doll inside it. You can never create a new doll or rearrange the pieces to make a bigger one.
Why it helped: If every rule in the protocol followed this "take it apart" rule, the detective could easily solve the mystery. The computer knew exactly how to break things down, and the answer was always "Yes, I can solve this" or "No, I can't."

The Problem: Many real-world security protocols are more complex. They don't just take things apart; they sometimes rearrange pieces or swap parts around.

Example: A rule might say, "Take a blind signature, unblind it, and swap the order of the names."
The old "Russian Doll" rule said, "This is too messy! We can't guarantee we can solve this." So, for these complex protocols, scientists had to write a brand-new, unique proof for every single one to show it was safe. It was like having to hire a different detective for every single case because the old detective didn't know how to handle "swapping" clues.

The New Solution: Graph-Embedded Systems

The authors of this paper introduced a new way of looking at these rules. They call them Graph-Embedded Systems.

The Analogy: Imagine the terms (the messages) are not just Russian Dolls, but Lego structures.

In the old method, you could only pull a Lego brick off the top.
In this new method, the authors say: "Let's look at the Lego structure as a map or a graph."
They realized that even if you rearrange the Legos (swap a red brick with a blue one, or move a brick from the left side to the right), you are still working with the same underlying "shape" or "graph."
They created a new set of rules (based on Graph Theory) that allows for this rearranging. It's like saying, "As long as the pieces are still connected in a way that resembles the original map, we can still track them."

This new definition is much more flexible. It captures almost all the complex protocols that the old "Russian Doll" rule missed.

The Twist: Not All Graphs Are Safe

Here is where it gets tricky. The authors discovered that while this new "Graph" method is great, it's too flexible.

The Bad News: If you allow any kind of graph rearrangement, the detective's job becomes impossible. The computer gets stuck in an infinite loop trying to figure out if a secret can be found. The problem becomes Undecidable (there is no algorithm that can always give a Yes/No answer).
The Good News: The authors found a special sub-group of these graph rules called Contracting Convergent Systems.

The Analogy: Think of Contracting Systems as a "Strict Lego Master."

This master allows you to rearrange Legos (swap colors, move pieces), BUT there is one golden rule: Every time you make a move, the structure must get smaller or simpler in a specific way.
You can't build a bigger tower; you can only break it down or shuffle it while shrinking it.
Because of this "shrinking" rule, the detective knows the process will eventually stop. The computer can solve the mystery!

Why This Matters

It Unifies the Rules: Instead of writing a unique proof for every complex protocol (like blind signatures or malleable encryption), scientists can now say, "Hey, this protocol fits into our new 'Contracting' category. We already know how to solve it!"
It's Practical: They showed that many real-world protocols (like those used for digital signatures and secure messaging) fit into this new "Contracting" box.
It Connects to Other Tools: They proved that this new system works well with other existing tools used by security experts (like the YAPA tool), meaning it can be used immediately in real-world security analysis.

Summary in One Sentence

The authors created a new, flexible way to look at security rules (Graph-Embedded) that handles complex "rearranging" of data, and then found a safe, shrinking subset of those rules (Contracting) that guarantees we can always mathematically prove whether a hacker can steal a secret or not.

The "Takeaway" Metaphor

Old Way: "If you can't take the box apart piece by piece without breaking it, we can't check if it's safe."
New Way: "We can check if it's safe even if you shuffle the pieces around, as long as every shuffle makes the box slightly easier to open."

1. Problem Statement

In the symbolic analysis of security protocols, determining an attacker's knowledge is a fundamental task. This is formalized through two primary "knowledge problems":

Deduction: Can the attacker derive a specific term from a set of known messages (a frame)?
Static Equivalence: Can the attacker distinguish between two different protocol executions (frames)?

Historically, decidability results for these problems have relied on subterm convergent Term Rewrite Systems (TRS). In a subterm convergent TRS, the right-hand side of every rewrite rule is either a strict subterm of the left-hand side or a constant. While many decision procedures (e.g., those in [AC06, BCD13]) are proven sound and complete for subterm convergent systems, many practical security protocols (e.g., blind signatures, malleable encryption) utilize theories that are "beyond subterm convergent."

The Core Problem: These "beyond subterm" theories often work with existing decision procedures, but because they do not fit the strict syntactic definition of subterm convergence, their decidability must be proven individually for each case. There is a lack of a unified syntactic definition that encompasses these useful "beyond subterm" examples while preserving the decidability guarantees required for automated protocol analysis.

2. Methodology

The authors introduce a new class of rewrite systems inspired by graph theory, specifically the concepts of graph minors and graph embeddings.

Graph-Embedded TRS: The authors define a new relation, $t \succeq_{gemb} t'$ , based on a set of rewrite schemata ( $R_{gemb}$ ) that simulate edge contractions and permutations on term graphs. A TRS is "graph-embedded" if every rule $l \to r$ satisfies $l \succeq_{gemb} r$ (or $r$ is a constant). This generalizes the well-known homeomorphic embedding property.
Contracting Convergent Systems: Recognizing that general graph-embedded systems are too broad, the authors define a restricted subclass called contracting convergent systems.
- Key Mechanism: These systems require the existence of "projecting rules." If a rewrite rule modifies the structure of a term such that a subterm is moved or permuted (violating strict subterm properties), the system must possess specific rules that allow the attacker to "project" or extract the necessary subterms.
- Projection-Closed Derivations: The definition ensures that any derivation involving graph-embedded steps can be "closed" by projecting rules, ensuring that the attacker's ability to deduce subterms is preserved.
Local Stability: The authors leverage the concept of local stability (introduced in [AC06]). They prove that contracting convergent systems satisfy local stability, a property sufficient to guarantee the decidability of deduction and static equivalence.

3. Key Contributions

A. New Definitions and Hierarchy

Graph-Embedded TRS: A generalization of homeomorphic embedding that allows for more flexible structural changes (permutations and contractions) in rewrite rules.
Contracting TRS: A specific subclass of graph-embedded TRSs that enforces the existence of projecting rules. This class successfully captures many "beyond subterm" protocols (e.g., blind signatures, addition theories) that were previously outside the scope of standard decidability proofs.

B. Decidability Results

Main Theorem: The knowledge problems (deduction and static equivalence) are decidable for the class of contracting convergent TRSs.
Undecidability: The authors prove that the knowledge problems are undecidable for the general class of graph-embedded convergent TRSs (without the contracting restriction). They provide a reduction from the Modified Post Correspondence Problem (MPCP) to demonstrate this.

C. Relations to Existing Properties

The paper situates the new definitions within the broader landscape of protocol analysis:

Finite Variant Property (FVP): The authors show that while some contracting systems have the FVP, the class does not strictly imply it. They provide an example (Addition theory) that is contracting and decidable but lacks the FVP.
Layered Systems: They prove that every contracting TRS is a layered TRS. This implies that the YAPA tool (which relies on the layered property) will not fail (return "don't know") when applied to contracting systems.
Cap Problem: They extend decidability results to the "cap problem" (accessing a specific secret) for contracting systems with a complete intruder repertoire.

D. Combination Results

The paper presents modularity results for combining theories:

Union of Contracting Systems: The union of two contracting convergent TRSs (sharing only constructor symbols) remains contracting convergent.
Union with Permutative Theories: The authors show that deduction remains decidable when a contracting convergent TRS is combined with a permutative equational theory (e.g., commutativity), provided shared symbols are constructors.

4. Key Results and Examples

The paper validates the theory with several concrete examples from security protocol literature:

Blind Signatures: The theory of blind signatures (which was previously known to be decidable but not subterm convergent) is proven to be a contracting convergent TRS.
Addition Theory: The theory of addition ( $plus(x, s(y)) \to plus(s(x), y)$ ) is shown to be contracting and decidable, despite not having the Finite Variant Property.
Malleable Encryption: The paper distinguishes between systems that are graph-embedded but not contracting (and thus potentially undecidable) versus those that are contracting.

5. Significance

Unification: This work provides a unified syntactic framework that encompasses a wide range of "beyond subterm" protocols. Instead of proving decidability case-by-case for each new protocol, researchers can now check if a protocol fits the "contracting" definition.
Tooling: By establishing that contracting systems are "layered," the paper ensures that existing automated tools like YAPA can successfully analyze these systems without manual intervention.
Theoretical Boundary: The paper clearly delineates the boundary between decidable and undecidable knowledge problems in the context of graph-embedded systems, showing that the "contracting" restriction is necessary to maintain decidability.
Future Directions: The results open the door for analyzing more complex cryptographic primitives that involve structural permutations and non-subterm reductions, which were previously difficult to handle formally.

In summary, the paper successfully extends the reach of automated security protocol verification by defining a robust, decidable class of rewrite systems (contracting convergent) that captures the complexity of real-world cryptographic protocols while maintaining the theoretical guarantees required for sound analysis.