arXiv:1708.08340v1 [cs.CR] 28 Aug 2017

A Type System for Privacy Properties (Technical Report)
Véronique Cortier

Niklas Grimm

CNRS, LORIA
Nancy, France
veronique.cortier@loria.fr

TU Wien
Vienna, Austria
niklas.grimm@tuwien.ac.at

Joseph Lallemand

Matteo Maﬀei

Inria, LORIA
Nancy, France
joseph.lallemand@loria.fr

TU Wien
Vienna, Austria
matteo.maﬀei@tuwien.ac.at

ABSTRACT
Mature push button tools have emerged for checking trace properties (e.g. secrecy or authentication) of security protocols. The case
of indistinguishability-based privacy properties (e.g. ballot privacy
or anonymity) is more complex and constitutes an active research
topic with several recent propositions of techniques and tools.
We explore a novel approach based on type systems and provide a (sound) type system for proving equivalence of protocols,
for a bounded or an unbounded number of sessions. The resulting prototype implementation has been tested on various protocols of the literature. It provides a signiﬁcant speed-up (by orders
of magnitude) compared to tools for a bounded number of sessions
and complements in terms of expressiveness other state-of-the-art
tools, such as ProVerif and Tamarin: e.g., we show that our analysis technique is the ﬁrst one to handle a faithful encoding of the
Helios e-voting protocol in the context of an untrusted ballot box.

1

INTRODUCTION

Formal methods proved to be indispensable tools for the analysis
of advanced cryptographic protocols such as those for key distribution [43], mobile payments [30], e-voting [12, 29, 35], and ehealth [38]. In the last years, mature push-button analysis tools
have emerged and have been successfully applied to many protocols from the literature in the context of trace properties such
as authentication or conﬁdentiality. These tools employ a variety
of analysis techniques, such as model checking (e.g., Avispa [10]
and Scyther [33]), Horn clause resolution (e.g., ProVerif [19]), term
rewriting (e.g., Scyther [33] and Tamarin [40]), and type systems [11,
17, 22, 36].
A current and very active topic is the adaptation of these techniques to the more involved case of trace equivalence properties.
These are the natural symbolic counterpart of cryptographic indistinguishability properties, and they are at the heart of privacy properties such as ballot privacy [35], untraceability [7], or anonymity [4,
8]. They are also used to express stronger forms of conﬁdentiality,
such as strong secrecy [31], or game-based like properties [27].
Related Work. Numerous model checking-based tools have recently been proposed for the case of a bounded number of sessions, i.e., when protocols are executed a bounded number of times.
These tools encompass SPEC [34], APTE [13, 24], Akiss [23], or
SAT-Equiv [28]. These tools vary in the class of cryptographic primitives and the class of protocols they can consider. However, due

to the complexity of the problem, they all suﬀer from the state explosion problem and most of them can typically analyse no more
than 3-4 sessions of (relatively small) protocols, with the exception of SAT-Equiv which can more easily reach about 10 sessions.
The only tools that can verify equivalence properties for an unbounded number of sessions are ProVerif [21]. Maude-NPA [42],
and Tamarin [16]. ProVerif checks a property that is stronger than
trace equivalence, namely diﬀ equivalence, which works well in
practice provided that protocols have a similar structure. However,
as for trace properties, the internal design of ProVerif renders the
tool unable to distinguish between exactly one session and inﬁnitely many: this over-approximation often yields false attacks, in
particular when the security of a protocol relies on the fact that
some action is only performed once. Maude-NPA also checks diﬀequivalence but often does not terminate. Tamarin can handle an
unbounded number of sessions and is very ﬂexible in terms of supported protocol classes but it often requires human interactions.
Finally, some recent work has started to leverage type systems to
enforce relational properties for programs, exploring this approach
also in the context of cryptographic protocol implementation [14]:
like ProVerif, the resulting tool is unable to distinguish between
exactly one session and inﬁnitely many, and furthermore it is only
semi-automated, in that it often requires non-trivial lemmas to
guide the tool and a speciﬁc programming discipline.
Many recent results have been obtained in the area of relational
veriﬁcation of programs using Relational Hoare Logic [15, 18, 44].
The results hold on programs and cannot be directly applied to
cryptographic protocols due to the more special treatment of the
primitives.
Our contribution. In this paper, we consider a novel type checkingbased approach. Intuitively, a type system over-approximates protocol behavior. Due to this over-approximation, it is no longer possible to decide security properties but the types typically convey
suﬃcient information to prove security. Extending this approach
to equivalence properties is a delicate task. Indeed, two protocols
P and Q are in equivalence if (roughly) any trace of P has an equivalent trace in Q (and conversely). Over-approximating behavior
may not preserve equivalence.
Instead, we develop a somewhat hybrid approach: we design
a type system to over-approximate the set of possible traces and
we collect the set of sent messages into constraints. We then propose a procedure for proving (static) equivalence of the constraints.
These do not only contain sent messages but also reﬂect internal

checks made by the protocols, which is crucial to guarantee that
whenever a message is accepted by P, it is also accepted by Q (and
conversely).
As a result, we provide a sound type system for proving equivalence of protocols for both a bounded and an unbounded number
of sessions, or a mix of both. This is particularly convenient to
analyse systems where some actions are limited (e.g., no revote, or
limited access to some resource). More speciﬁcally, we show that
whenever two protocols P and Q are type-checked to be equivalent, then they are in trace equivalence, for the standard notion
of trace equivalence [39], against a full Dolev-Yao attacker. In particular, one advantage of our approach is that it proves security
directly in a security model that is similar to the ones used by
the other popular tools, in contrast to many other security proofs
based on type systems. Our result holds for protocols with all standard primitives (symmetric and asymetric encryption, signatures,
pairs, hash), with atomic long-term keys (no fresh keys) and no
private channels. Similarly to ProVerif, we need the two protocols
P and Q to have a rather similar structure.
We provide a prototype implementation of our type system, that
we evaluate on several protocols of the literature. In the case of a
bounded number of sessions, our tool provides a signiﬁcant speedup (less than one second to analyse a dozen of sessions while other
tools typically do not answer within 12 hours, with a few exceptions). To be fair, let us emphasize that these tools can decide equivalence while our tool checks suﬃcient conditions by the means of
our type system. In the case of an unbounded number of sessions,
the performance of our prototype tool is comparable to ProVerif.
In contrast to ProVerif, our tool can consider a mix of bounded and
unbounded number of sessions. As an application, we can prove
for the ﬁrst time ballot privacy of the well-known Helios e-voting
protocol [6], without assuming a reliable channel between honest
voters and the ballot box. ProVerif fails in this case as ballot privacy
only holds under the assumption that honest voters vote at most
once, otherwise the protocol is subject to a copy attack [41]. For
similar reasons, also Tamarin fails to verify this protocol.
In most of our example, only a few straightforward type annotations were needed, such as indicated which keys are supposed to
be secret or public. The case of the helios protocol is more involved
and requires to describe the form of encrypted ballots that can be
sent by a voter.
Our prototype, the protocol models, as well as a technical report
are available here [1].

2

OVERVIEW OF OUR APPROACH

In this section, we introduce the key ideas underlying our approach
on a simpliﬁed version of the Helios voting protocol. Helios [6] is
a veriﬁable voting protocol that has been used in various elections,
including the election of the rector of the University of Louvain-laNeuve. Its behavior is depicted below:

r
where {m}pk(k)
denotes the asymmetric encryption of message m
with the key pk(k) randomized with the nonce r , and [m]k denotes
the signature of m with key k. vi is a value in the set {0, 1}, which
represents the candidate Vi votes for. In the ﬁrst step, the voter
casts her vote, encrypted with the election’s public key pk(ks ) and
then signed. Since generating a good random number is diﬃcult
for the voter’s client (typically a JavaScript run in a browser), a
typical trick is to input some randomness (r i ) from the server and
to add it to its own randomness (r i′ ). In the second step the server
outputs the tally (i.e., a randomized permutation of the valid votes
received in the voting phase). Note that the original Helios protocol does not assume signed ballots. Instead, voters authenticate
themselves through a login mechanism. For simplicity, we abstract
this authenticated channel by a signature.
A voting protocol provides vote privacy [35] if an attacker is not
able to know which voter voted for which candidate. Intuitively,
this can be modeled as the following trace equivalence property,
which requires the attacker not to be able to distinguish A voting
0 and B voting 1 from A voting 1 and B voting 0. Notice that the
attacker may control an unbounded number of voters:

V oter (k a , 0) | V oter (kb , 1) | CompromisedVoters | S
≈t V oter (k a , 1) | V oter (kb , 0) | CompromisedVoters | S
Despite its simplicity, this protocol has a few interesting features
that make its analysis particularly challenging. First of all, the server
is supposed to discard ciphertext duplicates, otherwise a malicious
eligible voter E could intercept A’s ciphertext, sign it, and send it
to the server [32], as exempliﬁed below:
A→S :
E →S :
B →S :

r ,r ′

a a
[{v a }pk(k
]
)

s ka
r a ,r a′
[{v a }pk(k ) ]
s ke

r b ,r ′

[{vb } pk(kb ) ]
s

kb

S → A, B : v a ,vb ,v a
This would make the two tallied results distinguishable, thereby
breaking trace equivalence since v a ,vb ,v a 6≈t vb ,v a ,vb
Even more interestingly, each voter is supposed to be able to
vote only once, otherwise the same attack would apply [41] even if
the server discards ciphertext duplicates (as the randomness used
by the voter in the two ballots would be diﬀerent). This makes
the analysis particularly challenging, and in particular out of scope
of existing cryptographic protocol analyzers like ProVerif, which
abstract away from the number of protocol sessions.
With our type system, we can successfully verify the aforementioned privacy property using the following types:
1
1 ′
1 ′
1
r a : τrLL,
, rb : τrLL,
, r a : τrHH,
, rb : τrHH,
′
′
a
b
a
b
1
k a : keyHH ({Jτ0LL, 1 ; τ1LL, 1 K ∗ HL ∗ τrHH,
} )
′
a

S → Vi :
Vi → S :

ri
r i ,r i′
[{vi } pk(k
]
s ) ki

S → V1 , . . . ,Vn : v 1 , . . . ,vn

kb : key

HH

ks : key

HH

1
}
({Jτ1LL, 1 ; τ0LL, 1 K ∗ HL ∗ τrHH,
′
b

ks

ks
LL, 1
LL, 1
HH, 1
(Jτ0 ; τ1 K ∗ HL ∗ τr ′ )
a
1
(Jτ1LL, 1 ; τ0LL, 1 K ∗ HL ∗ τrHH,
)
′
b

)

∨

!

We assume standard security labels: HH stands for high conﬁdentiality and high integrity, HL for high conﬁdentiality and low integrity,
and LL for low conﬁdentiality and low integrity (for simplicity, we
omit the low conﬁdentiality and high integrity type, since we do
not need it in our examples). The type τil, 1 describes randomness
of security label l produced by the randomness generator at position i in the program, which can be invoked at most once. τil, ∞ is
similar, with the diﬀerence that the randomness generator can be
invoked an unbounded number of times. These types induce a partition on random values, in which each set contains at most one
element or an unbounded number of elements, respectively. This
turns out to be useful, as explained below, to type-check protocols,
like Helios, in which the number of times messages of a certain
shape are produced is relevant for the security of the protocol.
The type of k a (resp. kb ) says that this key is supposed to encrypt 0 and 1 (resp. 1 and 0) on the left- and right-hand side of
the equivalence relation, further describing the type of the randomness. The type of ks inherits the two payload types, which
are combined in disjunctive form. In fact, public key types implicitly convey an additional payload type, the one characterizing messages encrypted by the attacker: these are of low conﬁdentiality
and turn out to be the same on the left- and right-hand side. Key
types are crucial to type-check the server code: we verify the signatures produced by A and B and can then use the ciphertext type
derived from the type of k a and kb to infer after decryption the
vote cast by A and B, respectively. While processing the other ballots, the server discards the ciphertexts produced with randomness
matching the one used by A or B: given that these random values
are used only once, we know that the remaining ciphertexts must
come from the attacker and thus convey the same vote on the leftand on the right-hand side. This suﬃces to type-check the ﬁnal output, since the two tallied results on the left- and right-hand side are
the same, and thus fulﬁll trace equivalence.
The type system generates a set of constraints, which, if “consistent”, suﬃce to prove that the protocol is trace equivalent. Intuitively, these constraints characterize the indistinguishability of
the messages output by the process. The constraints generated for
this simpliﬁed version of Helios are reported below:
C = {({sign(aenc(h0, hx, r a′ ii, pk(k S )), k a ) ∼
sign(aenc(h1, hx, r a′ ii, pk(k S )), k a ),
′
aenc(h0, hx, r a ii, pk(k S )) ∼ aenc(h1, hx, r a′ ii, pk(k S )),
sign(aenc(h1, hy, rb′ ii, pk(k S )), kb ) ∼
sign(aenc(h0, hy, rb′ ii, pk(k S )), kb ),
′
aenc(h1, hy, rb ii, pk(k S )) ∼ aenc(h0, hy, rb′ ii, pk(k S ))},
[x : LL, y : LL])}
These constraints are consistent if the set of left messages of the
constraints is in (static) equivalence with the set of the right messages of the constraints. This is clearly the case here, since encryption hides the content of the plaintext. Just to give an example of
non-consistent constraints, consider the following ones:
C ′ = {{h(n 1) ∼ h(n 2 ), h(n 1 ) ∼ h(n 1 )}}
where n 1 , n 2 are two conﬁdential nonces. While the ﬁrst constraint
alone is consistent, since n 1 and n 2 are of high conﬁdentiality and

the attacker cannot thus distinguish between h(n 1 ) and h(n 2 ), the
two constraints all together are not consistent, since the attacker
can clearly notice if the two terms output by the process are the
same or not. We developed a dedicated procedure to check the consistency of such constraints.

3 FRAMEWORK
In symbolic models, security protocols are typically modeled as
processes of a process algebra, such as the applied pi-calculus [3].
We present here a calculus close to [25] inspired from the calculus
underlying the ProVerif tool [20].

3.1 Terms
Messages are modeled as terms. We assume an inﬁnite set of names
N for nonces, further partitioned into the set F N of free nonces
(created by the attacker) and the set BN of bound nonces (created
by the protocol parties), an inﬁnite set of names K for keys, ranged
over by k, and an inﬁnite set of variables V. Cryptographic primitives are modeled through a signature F , that is a set of function
symbols, given with their arity (that is, the number of arguments).
Here, we will consider the following signature:
Fc = {pk, vk, enc, aenc, sign, h·, ·i, h}
that models respectively public and veriﬁcation key, symmetric
and asymmetric encryption, concatenation and hash. The companion primitives (symmetric and asymmetric decryption, signature
check, and projections) are represented by the following signature:
Fd = {dec, adec, checksign, π1 , π2 }
We also consider a set C of (public) constants (used as agents names
for instance). Given a signature F , a set of names N and a set of
variables V, the set of terms T (F , V, N ) is the set inductively deﬁned by applying functions to variables in V and names in N . We
denote by names(t) (resp. vars(t)) the set of names (resp. variables)
occurring in t. A term is ground if it does not contain variables.
Here, we will consider the set T (Fc ∪ Fd ∪ C, V, N ∪ K) of
cryptographic terms, simply called terms. Messages are terms from
T (Fc ∪ C, V, N ∪ K) with atomic keys, that is, a term t ∈ T (Fc ∪
C, V, N ∪ K) is a message if any subterm of t of the form pk(t ′ ),
vk(t ′ ), enc(t 1 , t ′ ), aenc(t 1 , t 2 ), or sign(t 1 , t ′ ) is such that t ′ ∈ K
and t 2 = pk(t 2′ ) with t 2′ ∈ K. We assume the set of variables to be
split into two subsets V = X ⊎ AX where X are variables used
in processes while AX are variables used to store messages. An
attacker term is a term from T (Fc ∪ Fd ∪ C, AX, F N ).
A substitution σ = {M 1 /x 1 , . . . , Mk /xk } is a mapping from variables x 1 , . . . , xk ∈ V to messages M 1 , . . . , Mk . We let dom(σ ) =
{x 1 , . . . , xk }. We say that σ is ground if all messages M 1 , . . . , Mk
Ð
are ground. We let names(σ ) = 1≤i ≤k names(Mi ). The application of a substitution σ to a term t is denoted tσ and is deﬁned as
usual.
The evaluation of a term t, denoted t ↓, corresponds to the application of the cryptographic primitives. For example, the decryption succeeds only if the right decryption key is used. Formally, t ↓

Destructors used in processes:
d ::= dec(·, k) | adec(·, k) | checksign(·, vk(k)) | π1 (·) | π2 (·)
Processes:
P, Q ::=
0
| new n.P
| out(M).P
| in(x).P
| P |Q
| let x = d(y) in P else Q
| if M = N then P else Q
| !P

for n ∈ BN(n bound in P)
for x ∈ X(x bound in P)
for x, y ∈ X(x bound in P)

where M, N are messages.
Figure 1: Syntax for processes.
is recursively deﬁned as follows.
u ↓=u
pk(t) ↓ = pk(t ↓)
vk(t) ↓ = vk(t ↓)
h(t) ↓ = h(t ↓)
ht 1 , t 2 i ↓ = ht 1 ↓, t 2 ↓i
enc(t 1 , t 2 ) ↓ = enc(t 1 ↓, t 2 ↓)
sign(t 1 , t 2 ) ↓ = sign(t 1 ↓, t 2 ↓)
aenc(t 1 , t 2 ) ↓ = aenc(t 1 ↓, t 2 ↓)
for some k ∈ K

if u ∈ N ∪ V ∪ K ∪ C
if t ↓∈ K
if t ↓∈ K
if t ↓, ⊥
if t 1 ↓, ⊥ and t 2 ↓, ⊥
if t 1 ↓, ⊥ and t 2 ↓∈ K
if t 1 ↓, ⊥ and t 2 ↓∈ K
if t 1 ↓, ⊥ and t 2 ↓= pk(k)

π1 (t) ↓ = t 1 if t ↓= ht 1 , t 2 i
π2 (t) ↓ = t 2 if t ↓= ht 1 , t 2 i
dec(t 1 , t 2 ) ↓ = t 3 if t 1 ↓= enc(t 3 , t 4 ) and t 4 = t 2 ↓
adec(t 1 , t 2 ) ↓ = t 3 if t 1 ↓= aenc(t 3 , pk(t 4 )) and t 4 = t 2 ↓
checksign(t 1 , t 2 ) ↓ = t 3 if t 1 ↓= sign(t 3 , t 4 ) and t 2 ↓= vk(t 4 )
t ↓ = ⊥ otherwise
Note that the evaluation of term t succeeds only if the underlying
keys are atomic and always returns a message or ⊥. We write t = ↓
t ′ if t ↓= t ′ ↓.

3.2

Processes

Security protocols describe how messages should be exchanged
between participants. We model them through a process algebra,
whose syntax is displayed in Figure 1. We identify processes up
to α-renaming, i.e., capture avoiding substitution of bound names
and variables, which are deﬁned as usual. Furthermore, we assume
that all bound names and variables in the process are distinct.
A conﬁguration of the system is a quadruple (E; P; ϕ; σ ) where:
• P is a multiset of processes that represents the current active processes;
• E is a set of names, which represents the private names of
the processes;
• ϕ is a substitution with dom(ϕ) ⊆ AX and for any x ∈
dom(ϕ), ϕ(x) (also denoted xϕ) is a message that only contains variables in dom(σ ). ϕ represents the terms already
output.
• σ is a ground substitution;

The semantics of processes is given through a transition relation
α
−−→ on the quadruples provided in Figure 2 (τ denotes a silent acw
tion). The relation −−−→∗ is deﬁned as the reﬂexive transitive cloα
sure of −−→, where w is the concatenation of all actions. We also
write equality up to silent actions =τ .
Intuitively, process new n.P creates a fresh nonce, stored in E,
and behaves like P. Process out(M).P emits M and behaves like
P. Process in(x).P inputs any term computed by the attacker provided it evaluates as a message and then behaves like P. Process
P | Q corresponds to the parallel composition of P and Q. Process
let x = d(y) in P else Q behaves like P in which x is replaced
by d(y) if d(y) can be successfully evaluated and behaves like Q
otherwise. Process if M = N then P else Q behaves like P if M
and N correspond to two equal messages and behaves like Q otherwise. The replicated process !P behaves as an unbounded number
of copies of P.
A trace of a process P is any possible sequence of transitions
in the presence of an attacker that may read, forge, and send messages. Formally, the set of traces trace(P) is deﬁned as follows.
w

trace(P) = {(w, new E.ϕ, σ )|(∅; {P }; ∅; ∅) −−−→∗ (E; P; ϕ; σ )}
Example 3.1. Consider the Helios protocol presented in Section 2.
For simplicity, we describe here a simpliﬁed version with only two
(honest) voters A and B and a voting server S. This (simpliﬁed) protocol can be modeled by the process:
new r a .V oter (k a ,v a , r a ) | new rb .V oter (kb , vb , rb ) | PS
where V oter (k,v, r ) represents voter k willing to vote for v using
randomness r while PS represents the voting server. V oter (k,v, r )
simply outputs a signed encrypted vote.
V oter (k,v, r ) = out(sign(aenc(hv, r i, pk(k S )), k))
The voting server receives ballots from A and B and then outputs the decrypted ballots, after some mixing.
PS =in(x 1 ).in(x 2 ).
let y1 = checksign(x 1 , vk(k a )) in
let y2 = checksign(x 2 , vk(kb )) in
let z 1 = adec(y1 , ks ) in let z 1′ = π1 (z 1 ) in
let z 2 = adec(y2 , ks ) in let z 2′ = π1 (z 2 ) in
(out(z 1′ ) | out(z 2′ ))

3.3 Equivalence
When processes evolve, sent messages are stored in a substitution
ϕ while private names are stored in E. A frame is simply an expression of the form new E.ϕ where dom(ϕ) ⊆ AX. We deﬁne
dom(new E.ϕ) as dom(ϕ). Intuitively, a frame represents the knowledge of an attacker.
Intuitively, two sequences of messages are indistinguishable to
an attacker if he cannot perform any test that could distinguish
them. This is typically modeled as static equivalence [3]. Here, we
consider of variant of [3] where the attacker is also given the ability to observe when the evaluation of a term fails, as deﬁned for
example in [25].

τ

(E; {P1 | P2 } ∪ P; ϕ; σ )
(E; {0} ∪ P; ϕ; σ )
(E; {new n.P } ∪ P; ϕ; σ )
(E; {out(t).P } ∪ P; ϕ; σ )

−−→
τ
−−→
τ
−−→
new ax n .out(ax n )

−−−−−−−−−−−−−−−−→ (E; {P } ∪ P; ϕ ∪ {t/axn }; σ )
if tσ is a ground term, ax n ∈ AX and n = |ϕ| + 1
in(R)

(E; {in(x).P } ∪ P; ϕ; σ )

(E; {let x = d(M) in P
(E; {let x = d(M) in P
(E; {if M = N then P
(E; {if M = N then P

(E; {P1 , P2 } ∪ P; ϕ; σ )
(E; P; ϕ; σ )
(E ∪ {n}; {P } ∪ P; ϕ; σ )

−−−−−−→
(E; {P } ∪ P; ϕ; σ ∪ {(Rϕσ ) ↓ /x })
if R is an attacker term such that vars(R) ⊆ dom(ϕ),
and (Rϕσ ) ↓, ⊥
τ
else Q } ∪ P; ϕ; σ )
−−→
(E; {P } ∪ P; ϕ; σ ∪ {d(Mσ ) ↓ /x })
if Mσ is ground and d(Mσ ) ↓, ⊥
τ
else Q } ∪ P; ϕ; σ )
−−→
(E; {Q } ∪ P; ϕ; σ )
if Mσ is ground and d(Mσ ) ↓= ⊥, i.e. d cannot be applied to Mσ
τ
else Q } ∪ P; ϕ; σ )
−−→
(E; {P } ∪ P; ϕ; σ )
if M, N are messages such that Mσ , N σ are ground and Mσ = N σ
τ
else Q } ∪ P; ϕ; σ )
−−→
(E; {Q } ∪ P; ϕ; σ )
if M, N are messages such that Mσ , N σ are ground and Mσ , N σ
τ
(E; {!P } ∪ P; ϕ; σ )
−−→
(E; {P, !P } ∪ P; ϕ; σ )

Par
Zero
New
Out
In

Let-In
Let-Else
If-Then
If-Else
Repl

Figure 2: Semantics
Deﬁnition 3.2 (Static Equivalence). Two ground frames new E.ϕ
and new E ′ .ϕ ′ are statically equivalent if and only if they have
the same domain, and for all attacker terms R, S with variables in
dom(ϕ) = dom(ϕ ′ ), we have
(Rϕ = ↓ Sϕ) ⇐⇒ (Rϕ ′ = ↓ Sϕ ′ )
Then two processes P and Q are in equivalence if no matter how
the adversary interacts with P, a similar interaction may happen
with Q, with equivalent resulting frames.
Deﬁnition 3.3 (Trace Equivalence). Let P, Q be two processes. We
write P ⊑t Q if for all (s,ψ , σ ) ∈ trace(P), there exists (s ′,ψ ′, σ ′ ) ∈
trace(Q) such that s =τ s ′ and ψ σ and ψ ′σ ′ are statically equivalent. We say that P and Q are trace equivalent, and we write P ≈t Q,
if P ⊑t Q and Q ⊑t P.
Note that this deﬁnition already includes the attacker’s behavior, since processes may input any message forged by the attacker.
Example 3.4. As explained in Section 2, ballot privacy is typically modeled as an equivalence property [35] that requires that
an attacker cannot distinguish when Alice is voting 0 and Bob is
voting 1 from the scenario where the two votes are swapped.
Continuing Example 3.1, ballot privacy of Helios can be expressed
as follows:
new r a .V oter (k a , 0, r a ) | new rb .V oter (kb , 1, rb ) | PS
≈t new r a .V oter (k a , 1, r a ) | new rb .V oter (kb , 0, rb ) | PS

4

TYPING

We now introduce a type system to statically check trace equivalence between processes. Our typing judgements thus capture
properties of pairs of terms or processes, which we will refer to
as left and right term or process, respectively.

l ::=
T ::=
|

LL | HL | HH
l | T ∗ T | keyl (T ) | (T )k | {T }k
l ′, a
Jτnl, a ; τm
K with a ∈ {1, ∞} | T ∨ T

Figure 3: Types for terms (selected)

4.1 Types
A selection of the types for messages are deﬁned in Figure 3 and explained below. We assume three security labels (namely, HH, HL, LL),
ranged over by l, whose ﬁrst (resp. second) component denotes the
conﬁdentiality (resp. integrity) level. Intuitively, messages of high
conﬁdentiality cannot be learned by the attacker, while messages
of high integrity cannot originate from the attacker. Pair types
describe the type of their components, as usual. Type keyl (T ) describes keys of security level l used to encrypt (or sign) messages
of type T . The type (T )k (resp. {T }k ) describes symmetric (resp.
asymmetric) encryptions with key k of a message of type T . The
type τil, a describes nonces and constants of security level l: the
label a ranges over {∞, 1}, denoting whether the nonce is bound
within a replication or not (constants are always typed with a = 1).
We assume a diﬀerent identiﬁer i for each constant and restriction
in the process. The type τil, 1 is populated by a single name, (i.e., i
describes a constant or a non-replicated nonce) and τil, ∞ is a special type, that is instantiated to τil,j 1 in the jth replication of the
l ′, a
process. Type Jτnl, a ; τm
K is a reﬁnement type that restricts the
set of values which can be taken by a message to values of type
l ′, a
τnl, a on the left and type τm
on the right. For a reﬁnement type
l, a
l, a
Jτn ; τn K with equal types on both sides we simply write τnl, a .
Messages of type T ∨ T ′ are messages that can have type T or type
T ′.

4.2

Constraints

When typing messages, we generate constraints of the form (M ∼
N ), meaning that the attacker sees M and N in the left and right
process, respectively, and these two messages are thus required to
be indistinguishable.

4.3

Typing Messages

Typing judgments are parametrized over a typing environment Γ,
which is a list of mappings from names and variables to types. The
typing judgement for messages is of the form the form Γ ⊢ M ∼
N : T → c which reads as follows: under the environment Γ, M
and N are of type T and either this is a high conﬁdentiality type
(i.e., M and N are not disclosed to the attacker) or M and N are
indistinguishable for the attacker assuming the set of constraints c
holds true. We present an excerpt of the typing rules for messages
in Figure 4 and comment on them in the following.
Conﬁdential nonces (i.e. nonces with label l = HH or l = HL)
are typed with their label from the typing environment. As the
attacker may not observer them, they may be diﬀerent in the left
and the right message and we do not add any constraints (TNonce).
Public terms are given type LL if they are the same in the left and
the right message (TNonceL, TCstFN, TPubKey, TVKey). We require keys and variables to be the same in the two processes, deriving their type from the environment (TKey and TVar). The rule
for pairs operates recursively component-wise (TPair).
For symmetric key encryptions (TEnc), we have to make sure
that the payload type matches the key type (which is achieved by
rule TEncH). We add the generated ciphertext to the set of constraints, because even though the attacker cannot read the plaintext, he can perform an equality check on the ciphertext that he
observed. If we type an encryption with a key that is of low conﬁdentiality (i.e., the attacker has access to it), then we need to make
sure the payload is of type LL, because the attacker can simply decrypt the message and recover the plaintext (TEncL). The rules
for asymmetric encryption are the same, with the only diﬀerence
that we can always chose to ignore the key type and use type LL
to check the payload. This allows us to type messages produced
by the attacker, which has access to the public key but does not
need to respect its type. Signatures are also handled similarly, the
diﬀerence here is that we need to type the payload with LL even
if an honest key is used, as the signature does not hide the content. The ﬁrst typing rule for hashes (THash) gives them type LL
and adds the term to the constraints, without looking at the arguments of the hash function: intuitively this is justiﬁed, because the
hash function makes it impossible to recover the argument. The
second rule (THashL) gives type LL only if we can also give type
LL to the argument of the hash function, but does not add any constraints on its own, it is just passing on the constraints created for
the arguments. This means we are typing the message as if the hash
function would not have been applied and use the message without the hash, which is a strictly stronger result. Both rules have
their applications: while the former has to be used whenever we
hash a secret, the latter may be useful to avoid the creation of unnecessary constraints when hashing terms like constants or public
nonces. Rule THigh states that we can give type HL to every message, which intuitively means that we can treat every message as

if it were conﬁdential. Rule TSub allows us to type messages according to the subtyping relation, which is standard and deﬁned
in Figure 5. Rule TOr allows us to give a union type to messages,
if they are typable with at least one of the two types. TLR1 and
TLR∞ are the introduction rules for reﬁnement types, while TLR’
and TLRL’ are the corresponding elimination rules. Finally, TLRVar allows to derive a new reﬁnement type for two variables for
which we have singleton reﬁnement types, by taking the left reﬁnement of the left variable and the right reﬁnement of the right
variable. We will see application of this rule in the e-voting protocol, where we use it to combine A’s vote (0 on the left, 1 on the
right) and B’s vote (1 on the left, 0 on the right), into a message
that is the same on both sides.

4.4 Typing Processes
The typing judgement for processes is of the form Γ ⊢ P ∼ Q → C
and can be interpreted as follows: If two processes P and Q can
be typed in Γ and if the generated constraint set C is consistent,
then P and Q are trace equivalent. We assume in this section that
P and Q do not contain replication and that variables and names
are renamed to avoid any capture. We also assume processes to be
given with type annotations for nonces.
When typing processes, the typing environment Γ is passed down
and extended from the root towards the leafs of the syntax tree of
the process, i.e., following the execution semantics. The generated
constraints C however, are passed up from the leafs towards the
root, so that at the root we get all generated constraints, modeling
the attacker’s global view on the process execution.
More precisely, each possible execution path of the process there may be multiple paths because of conditionals - creates its
own set of constraints c together with the typing environment
Γ that contains types for all names and variables appearing in c.
Hence a constraint set C is a set elements of the form (c, Γ) for a
set of constraints c. The typing environments are required in the
constraint checking procedure, as they helps us to be more precise
when checking the consistency of constraints.
An excerpt of our typing rules for processes is presented in Figure 6 and explained in the following. Rule PZero copies the current typing environment in the constraints and checks the wellformedness of the environment (Γ ⊢ ⋄), which is deﬁned as expected. Messages output on the network are possibly learned by
the attacker, so they have to be of type LL (POut). The generated
constraints are added to each element of the constraint set for the
continuation process, using the operator ∪∀ deﬁned as

C∪∀c ′ := (c ∪ c ′, Γ) | (c, Γ) ∈ C .
Conversely, messages input from the network are given type LL
(PIn). Rule PNew introduces a new nonce, which may be used
in the continuation processes. While typing parallel composition
(PPar), we type the individual subprocesses and take the product
union of the generated constraint sets as the new constraint set.
The product union of constraint sets is deﬁned as
C∪×C ′ := {(c ∪ c ′, Γ ∪ Γ ′ ) |
(c, Γ) ∈ C ∧ (c ′, Γ ′ ) ∈ C ′ ∧ Γ, Γ ′ are compatible}
where compatible environments are those that agree on the type of
all arguments of the shared domain. This operation models the fact

Γ(n) = τnl, a

l, a
Γ(m) = τm

l ∈ {HH, HL}

Γ ⊢n ∼m :l → ∅
k ∈ dom(Γ)
Γ ⊢ pk(k) ∼ pk(k) : LL → ∅

Γ ⊢ x ∼x :T → ∅

Γ ⊢ vk(k) ∼ vk(k) : LL → ∅

Γ ⊢ M ∼ N : (T )k → c

(TEnc)

Γ ⊢k ∼k :T → ∅

Γ ⊢ M ∼ N : LL → c ∪ {M ∼ N }

Γ(k) = keyHH (T )

Γ(k) = keyLL (T )

Γ ⊢ sign(M, k) ∼ sign(N , k) : LL → c
Γ ⊢ M ∼ N : LL → c
Γ ⊢ h(M) ∼ h(N ) : LL → c

Γ(k) = keyHH (T )

(TSignH)

names(M) ∪ names(N ) ∪ vars(M) ∪ vars(N ) ⊆ dom(Γ) ∪ F N
Γ ⊢ h(M) ∼ h(N ) : LL → {h(M) ∼ h(N )}

names(M) ∪ names(N ) ∪ vars(M) ∪ vars(N ) ⊆ dom(Γ) ∪ F N
Γ ⊢ M ∼ N : HL → ∅

Γ ⊢ M ∼ N :T′ → c

T ′ <: T

Γ ⊢ M ∼ N :T →c

′

Γ ⊢M ∼N :l →c
′

Γ ⊢ M ∼ N :T ∨ T′ → c

(TLR1 )

l ∈ {HL, HH}

l, 1
Γ ⊢ x ∼ x : Jτm
; τnl , 1 K → ∅

Γ ⊢ M ∼ N :T →c

(TSub)

l, 1
Γ(m) = τm
or m ∈ F N ∪ C ∧ l = LL
l ′, 1
Γ(n) = τn
or n ∈ F N ∪ C ∧ l ′ = LL
l, 1
Γ ⊢ m ∼ n : Jτm
; τnl , 1 K → ∅

(TAenc)

Γ ⊢ M ∼ N : {LL}k → c
k ∈ dom(Γ)
(TAencL)
Γ ⊢ M ∼ N : LL → c

Γ ⊢ M ∼ N : LL → c ′

(THashL)

l, a
Γ ⊢ M ∼ N : Jτm
; τnl, a K → c

(TEncH)

Γ ⊢ aenc(M, pk(k)) ∼ aenc(N , pk(k)) : {T }k → c

(TAencH)

(TSignL)

(TKey)

Γ ⊢ M ∼ N :T →c

Γ ⊢ sign(M, k) ∼ sign(N , k) : LL → c ∪ c ′ ∪ {sign(M, k) ∼ sign(N , k)}
Γ ⊢ M ∼ N : LL → c

(TCstFN)

(TPair)

Γ ⊢ M ∼ N : LL → c ∪ {M ∼ N }

(TEncL)

Γ(k) = keyHH (T )

Γ ⊢ M ∼ N :T →c

Γ(k) = T

(TVKey)

Γ ⊢ hM, M i ∼ hN , N ′i : T ∗ T ′ → c ∪ c ′

Γ(k) = keyLL (T )

Γ ⊢ M ∼ N : {T }k → c

a ∈ C ∪ FN
Γ ⊢ a ∼ a : LL → ∅

′

Γ ⊢ enc(M, k) ∼ enc(N , k) : (T )k → c
Γ ⊢ M ∼ N : LL → c

(TNonceL)

Γ ⊢ M′ ∼ N ′ : T ′ → c′

Γ ⊢ M ∼ N :T →c

(TVar)

Γ ⊢ M ∼ N :T →c
Γ ⊢ M ∼ N : (LL)k → c

Γ ⊢ n ∼ n : LL → ∅
k ∈ dom(Γ)

(TPubKey)

Γ(x) = T

Γ(n) = τnLL, a

(TNonce)

(TLR’)

l, ∞
Γ(m) = τm

′

Γ(n) = τnl , ∞
′

(TLR∞ )

Γ ⊢ M ∼ N : JτnLL, a ; τnLL, a K → c
Γ ⊢ M ∼ N : LL → c

′′′

(TLRL’)

′′′

l ,1
l ,1
Γ ⊢ y ∼ y : Jτm
K→∅
′ ; τn ′

l, 1
Γ ⊢ x ∼ y : Jτm
; τnl ′ , 1 K → ∅

(THigh)

(TOr)

l, ∞
Γ ⊢ m ∼ n : Jτm
; τnl , ∞ K → ∅
′′

(THash)

(TLRVar)

Figure 4: Rules for Messages
that a process P | P ′ can have every trace that is a combination of
any trace of P with any trace of P ′ . The branches that are discarded
due to incompatible environments correspond to impossible executions (e.g., taking the left branch in P and the right branch in P ′
in two conditionals with the same guard). POr is the elimination
rule for union types, which requires the continuation process to be
well-typed with both types.
To ensure that the destructor application fails or succeeds equally
in the two processes, we allow only the same destructor to be applied to the same variable in both processes (PLet). As usual, we
then type-check the then as well as the else branch and then take
the union of the corresponding constraints. The typing rules for destructors are presented in Figure 7. These are mostly standard: for
instance, after decryption, the type of the payload is determined

by the one of the decryption key, as long as this is of high integrity
(DDecH). We can as well exploit strong types for ciphertexts, typically introduced by verifying a surrounding signature (see, e.g.,
the types for Helios) to derive the type of the payload (DDecT). In
the case of public key encryption, we have to be careful, since the
public encryption key is accessible to the attacker: we thus give
the payload type T ∨ LL (rule DAdecH). For operations involving
corrupted keys (label LL) we know that the payload is public and
hence give the derived message type LL.
In the special case in which we know that the concrete value of
the argument of the destructor application is a nonce or constant
due to a reﬁnement type, and we know statically that any destructor application will fail, we only need to type-check the else branch

T <: T
T <: T ′

(SRefl)

T ′ <: T ′′

T <: T ′′
T1 <: T1′

T <: HL

(STrans)

(SHigh)

LL ∗ LL <: LL

(SPairL)

T2 <: T2′

(SPair)
(SPairS)
T1 ∗ T2 <: T1′ ∗ T2′
HH ∗ T <: HH
(SPairS’)
(SKey)
T ∗ HH <: HH
keyl (T ) <: l
T <: T ′
(T )k <: (T ′ )k

(SEnc)

T <: T ′
{T }k <: {T ′ }k

(SAenc)

Figure 5: Subtyping Rules

(PLetLR). As for destructor applications, the diﬃculty while typing conditionals is to make sure that the same branch is taken in
both processes (PIfL). To ensure this we use a trick: We type both
the left and the right operands of the conditional with type LL and
add both generated sets of constraints to the constraint set. Intuitively, this means that the attacker could perform the equality test
himself, since the guard is of type LL, which means that the conditional must take the same branch on the left and on the right. In
the special case in which we can statically determine the concrete
value of the terms in the conditional (because the corresponding
type is populated by a singleton), we have to typecheck only the
single combination of branches that will be executed (PIfLR). Another special case is if the messages on the right are of type HH
and the ones on the left of type LL. As a secret of high integrity
can never be equal to a public value of low integrity, we know that
both processes will take the else branch (PIfS). This rule is crucial,
since it may allow us to prune the low typing branch of asymmetric
decryption. The last special case for conditionals is when we have a
reﬁnement type with replication for both operands of the equality
check (PIfLR*). Although we know that the nonces on both sides
are of the same type and hence both are elements of the same set,
we cannot assume that they are equal, as the sets are inﬁnite, unlike in rule PIfLR. Yet, concrete instantiations of nonces will have
the same index for the left and the right process. This is because
we check for a variant of diﬀ-equivalence. This ensures that the
equality check always yields the same result in the two processes.
All these special cases highlight how a careful treatment of names
in terms of equivalence classes (statically captured by types) is a
powerful device to enhance the expressiveness of the analysis.
Finally, notice that we do not have any typing rule for replication: this is in line with our general idea of typing a bounded number of sessions and then extending this result to the unbounded
case in the constraint checking phase, as detailed in Section 6.

5

CONSISTENCY OF CONSTRAINTS

Our type system guarantees trace equivalence of two processes
only if the generated constraints are consistent. In this section we
give a slightly simpliﬁed deﬁnition of consistency of constraints

and explain how it captures the attacker’s capability to distinguish
processes based on their outputs.
To deﬁne consistency, we need the following ingredients:
• ϕ l(c) and ϕ r (c) denote the frames that are composed of the
left and the right terms of the constraints respectively (in
the same order).
Γ denotes the frame that is composed of all low conﬁden• ϕ LL
tiality nonces and keys in Γ, as well as all public encryption
keys and veriﬁcation keys in Γ. This intuitively corresponds
to the initial knowledge of the attacker.
• Let EΓ be the set of all nonces occurring in Γ.
• Two ground substitutions σ, σ ′ are well-formed in Γ if they
preserve the types for variables in Γ (i.e., Γ ⊢ σ (x) ∼ σ ′ (x) :
Γ(x) → c x ).
Deﬁnition 5.1 (Consistency). A set of constraints c is consistent
in an environment Γ if for all substitutions σ ,σ ′ well-typed in Γ the
Γ ∪ ϕ (c)σ ) and new E .(ϕ Γ ∪ ϕ (c)σ ′ ) are statframes new EΓ .(ϕ LL
r
Γ
l
LL
ically equivalent. We say that (c, Γ) is consistent if c is consistent
in Γ and that a constraint set C is consistent in Γ if each element
(c, Γ) ∈ C is consistent.
We deﬁne consistency of constraints in terms of static equivalence,
as this notion exactly captures all capabilities of our attacker: to distinguish two processes, he can arbitrarily apply constructors and
destructors on observed messages to create new terms, on which
he can then perform equality tests or check the applicability of destructors. We require that this property holds for any well-typed
substitutions, to soundly cover that fact that we do not know the
content of variables statically, except for the information we get
by typing. In Section 6.3 we introduce an algorithm to check consistency of constraints.

6 MAIN RESULTS
In this section, we state our two main soundness theorems, entailing trace equivalence by typing for the bounded and unbounded
case, and we explain how to automatically check consistency.

6.1 Soundness of the type system
Our type system soundly enforces trace equivalence: if we can
typecheck P and Q then P and Q are equivalent, provided that the
corresponding constraint set is consistent.
Theorem 6.1 (Typing implies trace eqivalence). For all P,
Q, and C, for all Γ containing only keys, if Γ ⊢ P ∼ Q → C and C is
consistent, then P ≈t Q.
To prove this theorem, we ﬁrst show that typing is preserved by
reduction, and guarantees that the same actions can be observed
on both sides. More precisely, we show that if P and Q are multisets of processes which are pairwise typably equivalent (with consistent constraints), and if a reduction step with action α can be
performed to reduce P into P ′, then Q can be reduced in one or
several steps, with the same action α, to some multiset Q ′ such
that the processes in P ′ and Q ′ are still typably equivalent (with
consistent constraints). This is done by carefully examining all the
possible typing rules used to type the processes in P and Q. In addition we show that the frames of messages output when reducing

Γ does not contain union types

Γ ⊢⋄

Γ ⊢ 0 ∼ 0 → (∅, Γ)
Γ ⊢ M ∼ N : LL → c

Γ ⊢P ∼Q →C

Γ ⊢ out(M).P ∼ out(N ).Q → C∪∀c

(PZero)

Γ, x : LL ⊢ P ∼ Q → C

(POut)

Γ ⊢ in(x).P ∼ in(x).Q → C

(PIn)

Γ, n : τnl, a ⊢ P ∼ Q → C

(PNew)
Γ ⊢ new n : τnl, a .P ∼ new n : τnl, a .Q → C
Γ, x : T ⊢ P ∼ Q → C
Γ, x : T ′ ⊢ P ∼ Q → C ′
Γ ⊢P ∼Q →C
Γ ⊢ P′ ∼ Q′ → C′
(PPar)
(POr)
Γ ⊢ P | P ′ ∼ Q | Q ′ → C∪×C ′
Γ, x : T ∨ T ′ ⊢ P ∼ Q → C ∪ C ′
Γ ⊢ d(y) : T

Γ, x : T ⊢ P ∼ Q → C

Γ ⊢ P′ ∼ Q′ → C′

Γ ⊢ let x = d(y) in P else P ′ ∼ let x = d(y) in Q else Q ′ → C ∪ C ′
′

l ,a
Γ(y) = Jτnl, a ; τm
K

Γ ⊢ P′ ∼ Q′ → C′

′

Γ ⊢ let x = d(y) in P else P ∼ let x = d(y) in Q else Q ′ → C ′
Γ ⊢P ∼Q →C
Γ ⊢ if M =
Γ

M′

Γ ⊢ P′ ∼ Q′ → C′
then P else

P′

Γ ⊢ M ∼ N : LL → c

∼ if N =

N′

then Q else

′
l, 1
⊢ M 1 ∼ N 1 : Jτm
; τnl , 1 K → ∅
Γ ⊢ M2 ∼
l, 1 ? l ′′, 1
l ′, 1 ? l ′′′, 1
′
b = (τm = τm′ )
b = (τn = τn′ )

Q′
′′

(PLetLR)

Γ ⊢ M ′ ∼ N ′ : LL → c ′
(PIfL)

→ C ∪ C ′ ∪∀ (c ∪ c ′ )
′′′

l ,1
l ,1
N 2 : Jτm
K→∅
′ ; τn ′

Γ ⊢ Pb ∼ Qb ′ → C

Γ ⊢ if M 1 = M 2 then P⊤ else P⊥ ∼ if N 1 = N 2 then Q ⊤ else Q ⊥ → C
Γ ⊢ P′ ∼ Q′ → C′
Γ ⊢ M ∼ N : LL → c
Γ ⊢ M ′ ∼ N ′ : HH → c ′
Γ ⊢ if M = M ′ then P else P ′ ∼ if N = N ′ then Q else Q ′ → C ′
′

l, ∞
Γ ⊢ M 1 ∼ N 1 : Jτm
; τnl , ∞ K → ∅
Γ ⊢P ∼Q →C

(PLet)

(PIfLR)
(PIfS)

′

l, ∞
Γ ⊢ M 2 ∼ N 2 : Jτm
; τnl , ∞ K → ∅
′
′
′
Γ ⊢P ∼Q →C

Γ ⊢ if M 1 = M 2 then P else P ′ ∼ if N 1 = N 2 then Q else Q ′ → C ∪ C ′

(PIfLR*)

Figure 6: Rules for processes
P and Q are typably equivalent with consistent constraints; and
that this entails their static equivalence.
This implies that if P and Q are typable with a consistent constraint, then for each trace of P, by induction on the length of the
trace, there exists a trace of Q with the same sequence of actions,
and with a statically equivalent frame. That is to say P ⊑t Q. Similarly we show Q ⊑t P, and we thus have P ≈t Q.
Since we do not have typing rules for replication, Theorem 6.1
only allows us to prove equivalence of protocols for a ﬁnite number
of sessions. An arguably surprising result, however, is that, thanks
to our inﬁnite nonce types, we can prove equivalence for an unbounded number of sessions, as detailed in the next section.

6.2

Typing replicated processes

For more clarity, in this section, without loss of generality we conl, ∞
sider that for each inﬁnite nonce type τm
appearing in the processes, the set of names BN contains an inﬁnite number of fresh
names {m i | i ∈ N} which do not appear in the processes or environments. We similarly assume that for all the variables x appearing in the processes, the set X of all variables also contains fresh

variables {xi | i ∈ N} which do not appear in the processes or
environments.
Intuitively, whenever we can typecheck a process of the form
l, ∞
new n : τnl, 1 . new m : τm
. P, we can actually typecheck

l, 1
l, 1
.Pk )
new n : τnl, 1 . (new m 1 : τm
.P1 | . . . | new m k : τm
1
k

where in Pi , the nonce m has been replaced by m i and variables x
have been renamed to xi .
Formally, we denote by [ t ]iΓ , the term t in which names n such
that Γ(n) = τnl, ∞ for some l are replaced by n i , and variables x are
replaced by xi .
′
l, ∞
Similarly, when a term is of type Jτm
; τpl , ∞ K, it can be of type
′

l, 1
l, ∞
Jτm
; τpl i, 1 K for any i. The nonce type τm
represents inﬁnitely
i
many nonces (one for each session). That is, for n sessions, the type
′
′
l, ∞
l, 1
Jτm
; τpl , ∞ K represents all Jτm
; τpl i, 1 K. Formally, given a type T ,
i

and then its expansion to n sessions as
HH

Γ(k) = key (T )

Γ(x) = LL

(DDecH)

Γ ⊢ dec(x, k) : T
Γ(k) = keyLL (T )

l, 1
l, 1
∪ {m : τm
| [ Γ ]i (m) = τm
}.

Γ(x) = LL

(DDecL)

Γ ⊢ dec(x, k) : LL
Γ(x) = (T )k

(DDecT)

Γ ⊢ dec(x, k) : T
Γ(k) = keyHH (T )

Γ(x) = LL

Γ ⊢ adec(x, k) : T ∨ LL
Γ(k) = keyLL (T )

Γ(x) = LL

Γ ⊢ adec(x, k) : LL
Γ(x) = {T }k
Γ ⊢ adec(x, k) : T
Γ(k) = keyHH (T )

Γ ⊢ checksign(x, vk(k)) : T
Γ(k) = key (T )

Γ(x) = LL

Γ ⊢ checksign(x, vk(k)) : LL
Γ(x) = T ∗ T ′
Γ ⊢ π1 (x) : T
Γ(x) = LL
Γ ⊢ π1 (x) : LL

(DFst)

(DFstL)

(DAdecH)
(DAdecL)

• [ Γ ]ni (x) = Γ ′ (x);
• or there exist types T1 ,. . . ,Tk ,T1′ ,. . . ,Tk′′ such that

(DCheckH)

[ Γ ]ni (x) = T1 ∨ . . . ∨ Tk ∨ Γ ′ (x) ∨ T1′ ∨ . . . ∨ Tk′′

(DCheckL)

Finally, when typechecking two processes containing nonces
with inﬁnite nonce types, we collect constraints that represent families of constraints.
Given a set of constraints c, and an environment Γ, we deﬁne the
renaming of c for session i in Γ as [ c ]iΓ = {[ u ]iΓ ∼ [ v ]iΓ | u ∼ v ∈
c}. This is propagated to constraint sets as follows: the renaming
of C for session i is [ C ]i = {([ c ]iΓ , [ Γ ]i ) | (c, Γ) ∈ C } and its
expansion to n sessions is [ C ]ni = {([ c ]iΓ , Γ ′ ) | ∃Γ. (c, Γ) ∈ C ∧
Γ ′ ∈ branches([ Γ ]ni )}.
Again, note that the size of [ C ]i does not depend on the number
of sessions considered, while the size of the types present in [ C ]ni
HH, ∞
does. For example, for C = {({h(x) ∼ h(x)}, [x : Jτm
; τpHH, ∞ K])},

Γ(x) = T ∗ T ′
Γ ⊢ π2 (x) : T ′
Γ(x) = LL
Γ ⊢ π2 (x) : LL

(DSnd)
(DSndL)

Figure 7: Destructor Rules

we deﬁne its expansion to n sessions, denoted [ T
[ l ]n = l
[ T ∗ T ′ ]n = [ T
′ n
h [ T + T i] = [ T
keyl (T )

h

n

]n ,

as follows.

]n ∗ [ T ′ ]n
]n + [ T ′ ]n

= keyl ([ T ]n )

[ (T )k ]n = ([ T ]n )k
[ {T }k ]n = {[ T ]n }k
[ T ∨ T ′ i]n = [ T ]n ∨ [ T ′ ]n
′

l, 1
Jτm
; τpl , 1 K

n

Note that in [ Γ ]ni , due to the expansion, the size of the types
depends on n.
By construction, the environments contained in the constraints
generated by typing do not contain union types. However, reﬁnement types with inﬁnite nonce types introduce union types when
expanded. In order to recover environments without union types
after expanding, which, as we will explain in the next subsection, is
needed for our consistency checking procedure, we deﬁne branches([ Γ ]ni )
as the set of all Γ ′ , with the same domain as [ Γ ]ni , such that for all
x, Γ ′ (x) is not a union type, and either

(DAdecT)

Γ(x) = LL

LL

[ Γ ]ni = {xi : [ T ]n | [ Γ ]i (xi ) = T } ∪ {k : [ T ]n | [ Γ ]i (k) = T }

′

l, 1
= Jτm
; τpl , 1 K
h
in
′
′
Ô
l, ∞
l, 1
Jτm
; τpl , ∞ K = nj=1 Jτm
; τpl j, 1 K
j

where l, l ′ ∈ {LL, HH, HL}, k ∈ K. Note that the size of the expanded
type [ T ]n depends on n.
We need to adapt typing environments accordingly. For any typing environment Γ, we deﬁne its renaming for session i as:
[ Γ ]i = {xi : T | Γ(x) = T } ∪ {k : T | Γ(k) = T }
l, 1
l, 1
∪ {m : τm
| Γ(m) = τm
}
l, 1
l, ∞
∪ {m i : τm
| Γ(m) = τm
}.
i

HH, ∞
we have [ C ]i = {({h(xi ) ∼ h(xi )}, [xi : Jτm
; τpHH, ∞ K])} and
Ôn
HH, 1
HH, 1
n
[ C ]i = {({h(xi ) ∼ h(xi )}, [xi : j=1 Jτm j ; τp j K])}.
Our type system is sound for replicated processes provided that
the collected constraint sets are consistent, when instantiated with
all possible instantiations of the nonces and keys.

Theorem 6.2. Consider P, Q, P ′ ,Q ′ , C, C ′, such that P, Q and P ′ ,
Q ′ do not share any variable. Consider Γ, containing only keys and
nonces with types of the form τnl, 1 .
Assume that P and Q only bind nonces with inﬁnite nonce types,
l, ∞
i.e. using new m : τm
for some label l; while P ′ and Q ′ only bind
l, 1
nonces with ﬁnite types, i.e. using new m : τm
.
Let us abbreviate by new n the sequence of declarations of each
nonce m ∈ dom(Γ). If
• Γ ⊢ P ∼ Q → C,
• Γ ⊢ P ′ ∼ Q ′ → C ′,
• C ′∪× (∪×1≤i ≤n [ C ]ni ) is consistent for all n,
then

new n. ((!P) | P ′ ) ≈t new n. ((!Q) | Q ′ ).

Theorem 6.1 requires to check consistency of one constraint set.
Theorem 6.2 now requires to check consistency of an inﬁnite family of contraint sets. Instead of deciding consistency, we provide a
procedure that checks a slightly stronger condition.

6.3

Procedure for consistency

Checking consistency of a set of constraints amounts to checking
static equivalence of the corresponding frames. Our procedure follows the spirit of [5] for checking computational indistinguishability: we ﬁrst open encryption, signatures and pairs as much as
possible. Note that the type of a key indicates whether it is public
or secret. The two resulting frames should have the same shape.
Then, for unopened components, we simply need to check that
they satisfy the same equalities.
From now on, we only consider constraint sets that can actually
be generated when typing processes, as these are the only ones for
which we need to check consistency.
Formally, the procedure check_const is described in Figure 8. It
consists of four steps. First, we replace variables with reﬁnements
of ﬁnite nonce types by their left and right values. In particular
a variable with a union type is not associated with a single value
and thus cannot be replaced. This is why the branching operation
needs to be performed when expanding environments containing
reﬁnements with types of the form τnl, ∞ . Second, we recursively
open the constraints as much as possible. Third, we check that the
resulting constraints have the same shape. Finally, as soon as two
constraints M ∼ M ′ and N ∼ N ′ are such that M, N are uniﬁable,
we must have M ′ = N ′, and conversely. The condition is slightly
more involved, especially when the constraints contain variables
of reﬁned types with inﬁnite nonce types.
Example 6.3. Continuing Example 3.1, when typechecked with
appropriate key types, the simpliﬁed model of Helios yields constraint sets containing notably the following two constraints.
{ aenc(h0, r a i, pk(ks )) ∼ aenc(h1, r a i, pk(ks )),
aenc(h1, rb i, pk(ks )) ∼ aenc(h0, rb i, pk(ks )) }

step1Γ (c) := JcKσ F , σ ′ , with
F

F := {x ∈ dom(Γ) |
′

l,1
∃m, n, l, l ′ . Γ(x ) = Jτm
; τnl ,1 K}

and σ F , σ F′ deﬁned by
′

 • dom(σ F ) = dom(σ F ) = F


• ∀x ∈ F . ∀m, n, l, l ′ .
′

l,1

Jτm
; τnl ,1 K ⇒ σ F (x ) = m ∧ σ F′ (x ) = n


step2Γ (c) is recursively deﬁned by, for all M , N , M ′ , N ′ :
• step2Γ ({ hM, N i ∼ hM ′, N ′ i } ∪ c ′ ) :=
step2Γ ({M ∼ M ′, N ∼ N ′ } ∪ c ′ )
• For all k ∈ K, if ∃T .Γ(k) = keyLL (T ):

• step2Γ ({enc(M, k) ∼ enc(M ′, k)} ∪ c, c ′ ) :=
step2Γ ({M ∼ M ′ } ∪ c ′ )
• step2Γ ({aenc(M, pk(k)) ∼ aenc(M ′, pk(k))} ∪ c, c ′ ) :=
step2Γ ({M ∼ M ′ } ∪ c ′ )
• step2Γ ({sign(M, k) ∼ sign(M ′, k)} ∪ c ′ ) :=
step2Γ ({M ∼ M ′ } ∪ c ′ )
• For all k ∈ K, if ∃T .Γ(k) = keyHH (T ):
step2Γ ({sign(M, k) ∼ sign(M ′, k)} ∪ c ′ ) :=
{sign(M, k) ∼ sign(M ′, k)} ∪ step2Γ ({M ∼ M ′ } ∪ c ′ )
• For all other terms M, N :
step2Γ ({M ∼ N } ∪ c ′ ) := {M ∼ N } ∪ step2Γ (c ′ ).
step3Γ (c) := check that for all M ∼ N ∈ c, M and N are both
• a key k ∈ K such that ∃T .Γ(k) = keyLL (T );
• nonces m, n ∈ N such that
∃a ∈ {1, ∞}. Γ(n) = τnLL,a ∧ Γ(m) = τnLL,a ,

• or public keys, veriﬁcation keys, or constants;
For simplicity, consider the set c containing only these two con• or enc(M ′, k), enc(N ′, k) such that ∃T .Γ(k) = keyHH (T );
straints, together with a typing environment Γ where r a and rb
• or either h(M ′ ), h(N ′ ) or aenc(M ′, pk(k)), aenc(N ′, pk(k)), where
1
1
, and ks is given type
are respectively given types τrHH,
and τrHH,
a
b
∃T .Γ(k) = keyHH (T ); such that M ′ and N ′ contain directly under
keyHH (T ) for some T .
pairs some n with Γ(n) = HH or k such that ∃T .Γ(k) = keyHH (T );
The procedure check_const({(c, Γ)}) can detect that the con• or sign(M ′, k), sign(N ′, k) such that ∃T .Γ(k) = keyHH (T ).
straint c is consistent and returns true. Indeed, as c does not contain variables, step1 Γ (c) simply returns (c, Γ). Since c only constep4Γ (c) := If for all M ∼ M ′ and N ∼ N ′ ∈ c such that M , N are
tains messages encrypted with secret keys, step2 Γ (c) also leaves
uniﬁable with a most general uniﬁer µ, and such that
c unmodiﬁed. step3 Γ (c) then returns true, since the messages ap′
l,∞
∀x ∈ dom(µ).∃l, l ′, m, p . (Γ(x ) = Jτm
; τpl ,∞ K) ⇒
pearing in c are messages asymmetrically encrypted with secret
(x µ ∈ X ∨ ∃i . x µ = mi )
keys, which contain a secret nonce (r a or rb ) directly under pairs.
we
have
Finally step4 Γ (c) trivially returns true, as the messages aenc(h0, r a i, pk(ks ))
M ′α θ = N ′α θ
and aenc(h1, rb i, pk(ks )) cannot be uniﬁed, as well as the messages
where
aenc(h1, r a i, pk(ks )) and aenc(h0, rb i, pk(ks )).
∀x ∈ dom(µ).∀l, l ′, m, p, i .
Consider now the following set c ′ , where encryption has not
′
l,∞
(Γ(x ) = Jτm
; τpl ,∞ K ∧ µ(x ) = mi ) ⇒ θ (x ) = p i
been randomised:

c ′ = { aenc(0, pk(ks )) ∼ aenc(1, pk(ks )),
aenc(1, pk(ks )) ∼ aenc(0, pk(ks )) }
The procedure check_const({(c ′, Γ)}) returns false. Indeed,
contrary to the case of c, step3 Γ (c ′ ) fails, as the encrypted message do not contain a secret nonce. Actually, the corresponding
frames are indeed not statically equivalent since the adversary can
reconstruct the encryption of 0 and 1 with the key pk(ks ) (in his
initial knowledge), and check for equality.

and α is the restriction of µ to {x ∈ dom(µ) | Γ(x ) = LL ∧ µ(x ) ∈ N };
and if the symmetric condition for the case where M ′ , N ′ are uniﬁable
holds as well, then return true.
check_const(C) := for all (c, Γ) ∈ C, let c 1 := step2Γ (step1Γ (c)) and
check that step3Γ (c 1 ) = true and step4 Γ (c 1 ) = true.

Figure 8: Procedure for checking consistency.

For constraint sets without inﬁnite nonce types, check_const
entails consistency.
Theorem 6.4. Let C be a set of constraints such that
′

l, ∞
∀(c, Γ) ∈ C. ∀l, l ′,m, p. Γ(x) , Jτm
; τpl , ∞ K.

If check_const(C) = true, then C is consistent.

Actually, checking consistency (with our procedure) of two constraints [ C ]n1 and [ C ]n2 entails consistency of ∪×1≤i ≤n [ C ]ni . Note
that this does not mean that consistency of [ C ]n1 and [ C ]n2 implies consistency of ∪×1≤i ≤n [ C ]ni . Instead, our procedure ensures
a stronger property, for which two constraints suﬃce.
Theorem 6.5. Let C and C ′ be two constraint sets, which do not
contain any common variables. For all n ∈ N,

We prove this theorem by showing that, for each of the ﬁrst
check_const([ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 ) = true ⇒
two steps of the procedure, if stepi Γ (c) is consistent in Γ, then c
check_const((∪×1≤i ≤n [ C ]ni )∪× [ C ′ ]n1 ) = true.
is consistent in Γ. It then suﬃces to check the consistency of the
constraint step2 Γ (step1 Γ (c)) in Γ. Provided that step3 Γ holds, we
It is rather easy to show that if
 n
show that this constraint is saturated in the sense that any message
check_const([ C ]n1 ∪× [ C ]n2 ∪× C ′ 1 ) = true,
obtained by the attacker by decomposing terms in the constraint
then the ﬁrst three steps of the procedure check_const can be
already occurs in the constraint; and the constraint only contains
successfully applied to each element of (∪×1≤i ≤n [ C ]ni )∪× [ C ′ ]n1 .
messages which cannot be reconstructed by the attacker from the
However the case of the fourth step is more intricate. When applyrest of the constraint. Using this property, we ﬁnally prove that the
ing the procedure check_const to an element of the constraint set
simple uniﬁcation tests performed in step4 are suﬃcient to ensure
(∪×1≤i ≤n [ C ]ni )∪× [ C ′ ]n1 , if step4 fails, then the constraint constatic equivalence of each side of the constraint for any well-typed
tains an inconsistency, i.e. elements M ∼ M ′ and N ∼ N ′ for
instantiation of the variables.
which the uniﬁcation condition from step4 does not hold. IntuAs a direct consequence of Theorems 6.1 and 6.4, we now have
itively, the property holds by contraposition thanks to the fact that
a procedure to prove trace equivalence of processes without replia similar inconsistency, up to reindexing the nonces and variables,
cation.
can then already be found when considering only the ﬁrst two
For proving trace equivalence of processes with replication, we
constraint sets, i.e. in [ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 . The actual proof reneed to check consistency of an inﬁnite family of constraint sets, as
quires a careful examination of the structure of the constraint set
prescribed by Theorem 6.2. As mentioned earlier, not only the num(∪×1≤i ≤n [ C ]ni )∪× [ C ′ ]n1 , to establish this reindexing.
ber of constraints is unbounded, but the size of the type of some
Ôn
l, 1
l ′, 1
(replicated) variables is also unbounded (i.e. of the form j=1 Jτm j ; τp j K).
6.5 Reducing the size of types
We use here two ingredients: we ﬁrst show that it is suﬃcient to
The
procedure check_const applied to replicated types implies
apply our procedure to two constraints only. Second, we show that
consistency
of corresponding constraints with unbounded types.
our procedure applied to variables with replicated types, i.e. nonce
l, ∞
types of the form τn implies consistency of the corresponding
Theorem 6.6. Let C be a constraint set. Then for all i,
constraints with types of unbounded size.
check_const([ C ]i ) = true ⇒
∀n ≥ 1.check_const([ C ]ni ) = true

6.4

Two constraints suﬃce

Consistency of a constraint set C does not guarantee consistency
of ∪×1≤i ≤n [ C ]ni . For example, consider
HH, ∞
C = {({h(m) ∼ h(p)}, [m : τm
, p : τpHH, 1 ])}

which can be obtained when typing
HH, ∞
new m : τm
. new p : τpHH, 1 . out(h(m)) ∼
HH, ∞
new m : τm . new p : τpHH, 1 . out(h(p)).

C is consistent: since m, p are secret, the attacker cannot distinguish between their hashes. However ∪×1≤i ≤n [ C ]ni contains (together with some environment):
{h(m 1 ) ∼ h(p), h(m 2 ) ∼ h(p), . . . , h(m n ) ∼ h(p)}
which is not, since the attacker can notice that the value on the
right is always the same, while the value on the left is not.
Note however that the inconsistency of ∪×1≤i ≤n [ C ]ni would
have been discovered when checking the consistency of two copies
of the constraint set only. Indeed, [ C ]n1 ∪× [ C ]n2 contains (together
with some environment):
{h(m 1 ) ∼ h(p), h(m 2 ) ∼ h(p)}
which is already inconsistent, for the same reason.

Again here, it is rather easy to show that if check_const([ C ]i ) =
true then the ﬁrst three steps of the procedure check_const can
successfully be applied to each element of [ C ]ni . The case of step4
is more involved. The property holds thanks to the condition on
the most general uniﬁer expressed in step4. Intuitively, this condition is written in such a way that if, when applying step4 to
an element of [ C ]ni , two messages can be uniﬁed, then the corresponding messages (with replicated types) in [ C ]i can be uniﬁed
with a most general uniﬁer µ satisfying the condition. The proof
uses this idea to show that if step4 succeeds on all elements of
[ C ]i , then it also succeeds on the elements of [ C ]ni .

6.6 Checking the consistency of the inﬁnite
constraint
Theorems 6.2, 6.5, and 6.6 provide a sound procedure for checking
trace equivalence of processes with and without replication.
Theorem 6.7. Let C, and C ′ be two constraint sets without any
common variable.
check_const([ C ]1 ∪× [ C ]2 ∪× [ C ′ ]1 ) = true ⇒
∀n. [ C ′ ]n1 ∪× (∪×1≤i ≤n [ C ]ni ) is consistent.
All detailed proofs are available online [1].

7

EXPERIMENTAL RESULTS

We have implemented a prototype type-checker TypeEq and applied it on various examples brieﬂy described below.
Symmetric key protocols. For the sake of comparison, we
consider 5 symmetric key protocols taken from the benchmark
of [28], and described in [26]: Denning-Sacco, Wide Mouth Frog,
Needham-Schroeder, Yahalom-Lowe, and Otway-Rees. All these
protocols aim at exchanging a key k. We prove strong secrecy of
the key, as deﬁned in [2], i.e., P(k 1 ) ≈t P(k 2 ) where k 1 and k 2
are public names. Intuitively, an attacker should not be able to
tell which key is used even if he knows the two possible values
in advance. For some of the protocols, we truncated the last step,
when it consists in using the exchanged key for encryption, since
our framework currently covers only encryption with long-term
(ﬁxed) keys.
Asymmetric key protocols. In addition to the symmetric key
protocols, we consider the well-known Needham-Schroeder-Lowe
(NSL) protocol [37] and we again prove strong secrecy of the nonce
sent by the receiver (Bob).
Helios. We model the Helios protocol for two honest voters
and inﬁnitely many dishonest ones, as informally described in Section 2. The corresponding process includes a non trivial else branch,
used to express the weeding phase [32], where dishonest ballots
equal to some honest one are discarded. As emphasised in Section 2, Helios is secure only if honest voters vote at most once.
Therefore the protocol includes non replicated processes (for voters) as well as a replicated process (to handle dishonest ballots).
All our experiments have been run on a single Intel Xeon E52687Wv3 3.10GHz core, with 378GB of RAM (shared with the 19
other cores). All corresponding ﬁles can be found online at [1].

7.1

Bounded number of sessions

We ﬁrst compare our tool with tools designed for a bounded number of sessions: SPEC [34], APTE (and its APTE-POR variant) [13,
24], Akiss [23], or SAT-Equiv [28]. The protocol models may slightly
diﬀer due to the subtleties of each tool. For example, several of
these tools require simple processes where each sub-process emits
on a distinct channel. We do not need such an assumption. In addition, SAT-Equiv only covers symmetric encryption and therefore
could not be applied to Helios or NSL. SAT-Equiv further assumes
protocols to be well-typed, which sometimes requires to tag protocols. Since we consider only untagged versions (following the original description of each protocol), SAT-Equiv failed to prove the
Otway-Rees protocol. Moreover, Helios involves non-trivial else
branches, which are only supported by APTE.
The number of sessions we consider denotes the number of processes in parallel in each scenario. For symmetric key protocols, we
start with a simple scenario with only two honest participants A, B
and a honest server S (3 sessions). We consider increasingly more
complex scenarios (6, 7, 10, 12, and 14 sessions) featuring a dishonest agent C. In the complete scenario (14 sessions) each agent
among A, B (and C) runs the protocol once as the initiator, and
once as the responder with each other agent (A, B, C). In the case
of NSL, we similarly consider a scenario with two honest agents A,
B running the protocol once (2 sessions), and two scenarios with

Protocols (# sessions)
3
6
Denning 7
Sacco
10
12
14
3
6
Wide Mouth
7
Frog
10
12
14
3
6
Needham 7
Schroeder
10
12
14
3
6
Yahalom 7
Lowe
10
12
14
3
6
7
Otway-Rees
10
12
14
Needham2
Schroeder4
Lowe
8
Helios
3

Akiss
0.08s
3.9s
29s
SO

APTE APTE-POR Spec
0.32s
0.02s
9s
TO
1.6s
191m
3.6s
TO
12m
TO

Sat-Eq
0.09s
0.3s
0.8s
1.8s
3.4s
5s
0.06s
0.2s
2.3s
5s
1m
4m20s
0.5s
4s
36s
1m50s
4m47s
11m
1.4s
1m
17m
63m
TO

0.03s
0.4s
1.4s
46s
71m
TO
0.1s
20s
2m
SO

0.05s
28m
TO

0.009s
0.4s
1.9s
5m31s
TO

8s
52m
MO

0.4s
TO

0.02s
4s
8m
TO

52s
MO

0.16s
33s
11m
SO

3.6s
TO

0.03s
44s
36m
TO

6s
132m
MO

2m12s
TO

BUG

1.7s
SO

27m
MO

x

0.1s
2m
TO
x

4s
BUG

0.06s
BUG

31s
MO

x

TO

BUG

x

x

TypeEq
0.002s
0.003s
0.004s
0.004s
0.005s
0.006s
0.002s
0.003s
0.003s
0.004s
0.005s
0.006s
0.003s
0.003s
0.003s
0.005s
0.005s
0.007s
0.003s
0.004s
0.004s
0.009s
0.04s
0.05s
0.004s
0.011s
0.012s
0.02s
0.03s
0.1s
0.003s
0.003s
0.007s
0.002s

Figure 9: Experimental results for the bounded case
an additional dishonest agent C, up to the complete scenario (8 sessions) where each agent runs NSL once as initiator, once as responder, with each agent. For Helios, we consider 2 honest voters, and
one dishonest voter only, as well as a ballot box. The corresponding results are reported in Figure 9. We write TO for Time Out (12
hours), MO for Memory Out (more than 64 GB of RAM), SO for
Stack Overﬂow, BUG in the case of APTE, when the proof failed
due to bugs in the tool, and x when the tool could not handle the
protocol for the reasons discussed previously. In all cases, our tool
is almost instantaneous and outperforms by orders of magnitude
the competitors.

7.2 Unbounded numbers of sessions
We then compare our type-checker with ProVerif [21], for an unbounded number of sessions, on three examples: Helios, DenningSacco, and NSL. As expected, ProVerif cannot prove Helios secure
since it cannot express that voters vote only once. This may sound
surprising, since proofs of Helios in ProVerif already exist (e.g. [9,
32]). Interestingly, these models actually implicitly assume a reliable channel between honest voters and the voting server: whenever a voter votes, she ﬁrst sends her vote to the voting server on
a secure channel, before letting the attacker see it. This model prevents an attacker from reading and blocking a message, while this
can be easily done in practice (by breaking the connection). We also
failed to prove (automatically) Helios in Tamarin [16]. The reason

Protocols
Helios
Denning-Sacco
Needham-Schroeder-Lowe

ProVerif
x
0.05s
0.08s

TypeEq
0.003s
0.05s
0.09s

Figure 10: Experimental results for unbounded numbers of
sessions
is that the weeding procedure makes Tamarin enter a loop where
it cannot detect that, as soon as a ballot is not weed, it has been
forged by the adversary.
For the sake of comparison, we run both tools (ProVerif and
TypeEq) on a symmetric protocol (Denning-Sacco) and an asymmetric protocol (Needham-Schroeder-Lowe). The execution times
are very similar. The corresponding results are reported in Figure 10.

8

CONCLUSION

We presented a novel type system for verifying trace equivalence
in security protocols. It can be applied to various protocols, with
support for else branches, standard cryptographic primitives, as
well as a bounded and an unbounded number of sessions. We believe that our prototype implementation demonstrates that this approach is promising and opens the way to the development of an efﬁcient technique for proving equivalence properties in even larger
classes of protocols.
Several interesting problems remain to be studied. For example,
a limitation of ProVerif is that it cannot properly handle global
states. We plan to explore this case by enriching our types to express the fact that an event is “consumed”. Also, for the moment,
our type system only applies to protocols P, Q that have the same
structure. One advantage of a type system is its modularity: it is relatively easy to add a few rules without redoing the whole proof. We
plan to add rules to cover protocols with diﬀerent structures (e.g.
when branches are swapped). Another direction is the treatment
of primitives with algebraic properties (e.g. Exclusive Or, or homomorphic encryption). It seems possible to extend the type system
and discharge the diﬃculty to the consistency of the constraints,
which seems easier to handle (since this captures the static case).
Finally, our type system is sound w.r.t. equivalence in a symbolic
model. An interesting question is whether it also entails computational indistinguishability. Again, we expect that an advantage of
our type system is the possibility to discharge most of the diﬃculty
to the constraints.

REFERENCES
[1] [n. d.]. https://sites.google.com/site/typesystemeq/
[2] Martín Abadi. 2000. Security Protocols and their Properties. In Foundations of Secure Computation. NATO Science Series, Vol. for the 20th International Summer
School on Foundations of Secure Computation held in Marktoberdorf Germany.
IOS Press, 39–60.
[3] Martín Abadi and Cédric Fournet. 2001. Mobile Values, New Names, and Secure Communication. In 28th ACM SIGPLAN-SIGACT Symposium on Principles
of Programming Languages (POPL’01). ACM, 104–115.
[4] Martín Abadi and Cédric Fournet. 2004. Private authentication. Theoretical Computer Science 322, 3 (2004), 427 – 476.
[5] M. Abadi and P. Rogaway. 2000. Reconciling two views of cryptography. In
International Conference on Theoretical Computer Science (IFIP TCS2000). 3–22.
[6] Ben Adida. 2008. Helios: web-based open-audit voting. In 17th conference on
Security symposium (SS’08). 335–348.
[7] M. Arapinis, T. Chothia, E. Ritter, and M. Ryan. 2009. Untraceability in the applied pi calculus. In 1st International Workshop on RFID Security and Cryptography.
[8] Myrto Arapinis, Tom Chothia, Eike Ritter, and Mark Ryan. 2010. Analysing
unlinkability and anonymity using the applied pi calculus. In 2nd IEEE Computer
Security Foundations Symposium (CSF’10). IEEE Computer Society Press.
[9] Myrto Arapinis, Véronique Cortier, and Steve Kremer. 2016. When are three
voters enough for privacy properties?. In 21st European Symposium on Research
in Computer Security (ESORICS’16) (Lecture Notes in Computer Science). Springer,
Heraklion, Crete, 241–260.
[10] A. Armando, D. Basin, Y. Boichut, Y. Chevalier, L. Compagna, J. Cuellar, P. Hankes Drielsma, P.-C. Héam, O. Kouchnarenko, J. Mantovani, S. Mödersheim, D.
von Oheimb, M. Rusinowitch, J. Santiago, M. Turuani, L. Viganò, and L. Vigneron. 2005. The AVISPA Tool for the automated validation of internet security
protocols and applications. In 17th International Conference on Computer Aided
Veriﬁcation, CAV’2005 (Lecture Notes in Computer Science), Vol. 3576. Springer,
Edinburgh, Scotland, 281–285.
[11] Michael Backes, Hritcu Catalin, and Matteo Maﬀei. 2014. Union, Intersection
and Reﬁnement Types and Reasoning About Type Disjointness for Secure Protocol Implementations. Journal of Computer Security 22, 2 (March 2014), 301–353.
http://dl.acm.org/citation.cfm?id=2595841.2595845
[12] Michael Backes, Catalin Hritcu, and Matteo Maﬀei. 2008. Automated Veriﬁcation of Remote Electronic Voting Protocols in the Applied Pi-Calculus.
In Proceedings of the 2008 21st IEEE Computer Security Foundations Symposium (CSF ’08). IEEE Computer Society, Washington, DC, USA, 195–209.
https://doi.org/10.1109/CSF.2008.26
[13] David Baelde, Stéphanie Delaune, and Lucca Hirschi. 2015. Partial Order Reduction for Security Protocols. In 26th International Conference on Concurrency
Theory (CONCUR’15) (LIPIcs), Vol. 42. Leibniz-Zentrum für Informatik, 497–510.
[14] Gilles Barthe, Cédric Fournet, Benjamin Grégoire, Pierre-Yves Strub, Nikhil
Swamy, and Santiago Zanella Béguelin. 2014. Probabilistic relational veriﬁcation for cryptographic implementations. In 41st Annual ACM SIGPLAN-SIGACT
Symposium on Principles of Programming Languages (POPL ’14). ACM, 193–206.
[15] Gilles Barthe, Benjamin Grégoire, and Santiago Zanella-Béguelin. 2009. Formal
certiﬁcation of code-based cryptographic proofs. In 36th ACM SIGPLAN-SIGACT
Symposium on Principles of Programming Languages, POPL 2009, Savannah, GA,
USA, January 21-23, 2009. ACM, 90–101.
[16] David Basin, Jannik Dreier, and Ralf Sasse. 2015. Automated Symbolic Proofs of
Observational Equivalence. In 22nd ACM SIGSAC Conference on Computer and
Communications Security (ACM CCS 2015). ACM, 1144–1155.
[17] Jesper Bengtson, Karthikeyan Bhargavan, Cédric Fournet, Andrew D. Gordon,
and Sergio Maﬀeis. 2011. Reﬁnement Types for Secure Implementations. ACM
Transactions on Programming Languages and Systems 33, 2 (2011), 8:1–8:45.
[18] Nick Benton. 2004. Simple Relational Correctness Proofs for Static Analyses
and Program Transformations. In 31st ACM SIGPLAN-SIGACT Symposium on
Principles of Programming Languages (POPL ’04). ACM, New York, NY, USA, 14–
25.
[19] Bruno Blanchet. 2001. An Eﬃcient Cryptographic Protocol Veriﬁer Based on
Prolog Rules. In 14th IEEE Computer Security Foundations Workshop (CSFW-14).
IEEE Computer Society, Cape Breton, Nova Scotia, Canada, 82–96.
[20] Bruno Blanchet. 2016. Modeling and Verifying Security Protocols with the Applied Pi Calculus and ProVerif. Foundations and Trends in Privacy and Security
1, 1–2 (2016), 1–135.
[21] Bruno Blanchet, Martín Abadi, and Cédric Fournet. 2008. Automated Veriﬁcation of Selected Equivalences for Security Protocols. Journal of Logic and Algebraic Programming 75, 1 (Feb.–March 2008), 3–51.
[22] Michele Bugliesi, Stefano Calzavara, Fabienne Eigner, and Matteo Maﬀei. 2015.
Aﬃne Reﬁnement Types for Secure Distributed Programming. ACM Transactions on Programming Languages and Systems 37, 4, Article 11 (Aug. 2015),
66 pages. https://doi.org/10.1145/2743018

[23] Rohit Chadha, Stefan Ciobâcă, and Steve Kremer. 2012. Automated veriﬁcation of equivalence properties of cryptographic protocols. In Programming Languages and Systems —21th European Symposium on Programming (ESOP’12) (Lecture Notes in Computer Science), Vol. 7211. Springer, Tallinn, Estonia, 108–127.
[24] Vincent Cheval. 2014. APTE: an Algorithm for Proving Trace Equivalence. In
20th International Conference on Tools and Algorithms for the Construction and
Analysis of Systems (TACAS’14) (Lecture Notes in Computer Science), Vol. 8413.
Grenoble, France, 587–592.
[25] Vincent Cheval, Véronique Cortier, and Antoine Plet. 2013. Lengths may break
privacy – or how to check for equivalences with length. In 25th International
Conference on Computer Aided Veriﬁcation (CAV’13) (Lecture Notes in Computer
Science), Vol. 8043. Springer, St Petersburg, Russia, 708–723.
[26] John Clark and Jeremy Jacob. 1997. A survey of authentication protocol literature: Version 1.0. (1997).
[27] Hubert Comon-Lundh and Véronique Cortier. 2008. Computational Soundness
of Observational Equivalence. In 15th ACM Conference on Computer and Communications Security (CCS’08). ACM Press, Alexandria, Virginia, USA, 109–118.
[28] Véronique Cortier, Stéphanie Delaune, and Antoine Dallon. 2017. SAT-Equiv: an
eﬃcient tool for equivalence properties. In 30th IEEE Computer Security Foundations Symposium (CSF’17). IEEE Computer Society Press.
[29] Véronique Cortier, Fabienne Eigner, Steve Kremer, Matteo Maﬀei, and Cyrille
Wiedling. 2015. Type-Based Veriﬁcation of Electronic Voting Protocols. In Proceedings of the 4th International Conference on Principles of Security and Trust
- Volume 9036. Springer-Verlag New York, Inc., New York, NY, USA, 303–323.
https://doi.org/10.1007/978-3-662-46666-7_16
[30] Veronique Cortier, Alicia Filipiak, Said Gharout, and Jacques Traore. [n. d.]. Designing and proving an EMV-compliant payment protocol for mobile devices. In
2nd IEEE European Symposium on Security and Privacy (EuroS&P’16). IEEE Computer Society.
[31] Véronique Cortier, Michaël Rusinowitch, and Eugen Zălinescu. 2006. Relating
Two Standard Notions of Secrecy. Springer Berlin Heidelberg, 303–318.
[32] Véronique Cortier and Ben Smyth. 2011. Attacking and ﬁxing Helios: An analysis of ballot secrecy. In 24th IEEE Computer Security Foundations Symposium
(CSF’11). IEEE Computer Society Press.
[33] C.J.F. Cremers. 2008. The Scyther Tool: Veriﬁcation, Falsiﬁcation, and Analysis of Security Protocols. In Computer Aided Veriﬁcation, 20th International
Conference, CAV 2008, Princeton, USA (Lecture Notes in Computer Science),
Vol. 5123/2008. Springer, 414–418.
[34] Jeremy Dawson and Alwen Tiu. 2010. Automating open bisimulation checking for the spi-calculus. In IEEE Computer Security Foundations Symposium (CSF
2010).
[35] Stéphanie Delaune, Steve Kremer, and Mark D. Ryan. 2009. Verifying Privacytype Properties of Electronic Voting Protocols. Journal of Computer Security 17,
4 (2009), 435–487.
[36] Riccardo Focardi and Matteo Maﬀei. 2011. Types for Security Protocols. In
Formal Models and Techniques for Analyzing Security Protocols. Cryptology and
Information Security Series, Vol. 5. IOS Press, Chapter 7, 143–181.
[37] Gavin Lowe. 1996. Breaking and ﬁxing the Needham-Schroeder public-key protocol using FDR. In Tools and Algorithms for the Construction and Analysis of
Systems (TACAS’96) (LNCS), Vol. 1055. Springer-Verlag, 147–166.
[38] Matteo Maﬀei, Kim Pecina, and Manuel Reinert. 2013. Security and Privacy by
Declarative Design. In Proceedings of the 2013 IEEE 26th Computer Security Foundations Symposium (CSF ’13). IEEE Computer Society, Washington, DC, USA,
81–96. https://doi.org/10.1109/CSF.2013.13
[39] M.Boreale, R. D. Nicola, and R. Pugliese. 2002. Proof techniques for cryptographic processes. SIAM J. Comput. 31, 3 (2002), 947–986.
[40] Simon Meier, Benedikt Schmidt, Cas Cremers, and David Basin. 2013. The
TAMARIN Prover for the Symbolic Analysis of Security Protocols. In Computer
Aided Veriﬁcation, 25th International Conference, CAV 2013, Princeton, USA (Lecture Notes in Computer Science), Vol. 8044. Springer, 696–701.
[41] Peter Roenne. 2016. Private communication. (2016).
[42] Sonia Santiago, Santiago Escobar, Catherine A. Meadows, and José Meseguer.
2014. A Formal Deﬁnition of Protocol Indistinguishability and Its Veriﬁcation
Using Maude-NPA. In STM 2014 (LNCS). 162–177.
[43] Benedikt Schmidt, Simon Meier, Cas J. F. Cremers, and David A. Basin. 2012.
Automated Analysis of Diﬃe-Hellman Protocols and Advanced Security Properties.. In 24th IEEE Computer Security Foundations Symposium (CSF’12). IEEE
Computer Society, 78–94.
[44] Hongseok Yang. 2007. Relational separation logic. Theor. Comput. Sci. 375, 1-3
(2007), 308–334.

branches(Γ) = {Γ}

Γ⊢⋄

Γ ⊢ 0 ∼ 0 → (∅, Γ)
Γ ⊢ M ∼ N : LL → c

Γ ⊢P ∼Q →C

Γ ⊢ out(M).P ∼ out(N ).Q → C∪∀c

(PZero)
Γ, x : LL ⊢ P ∼ Q → C

(POut)

Γ ⊢ in(x).P ∼ in(x).Q → C

(PIn)

Γ, n : τnl, a ⊢ P ∼ Q → C

(PNew)
Γ ⊢ new n : τnl, a .P ∼ new n : τnl, a .Q → C
Γ, x : T ⊢ P ∼ Q → C
Γ, x : T ′ ⊢ P ∼ Q → C ′
Γ ⊢P ∼Q →C
Γ ⊢ P′ ∼ Q′ → C′
(PPar)
(POr)
Γ ⊢ P | P ′ ∼ Q | Q ′ → C∪×C ′
Γ, x : T ∨ T ′ ⊢ P ∼ Q → C ∪ C ′
Γ ⊢ d(y) : T

Γ ⊢ P′ ∼ Q′ → C′

Γ, x : T ⊢ P ∼ Q → C

(PLet)

Γ ⊢ let x = d(y) in P else P ′ ∼ let x = d(y) in Q else Q ′ → C ∪ C ′
′

l ,a
Γ(y) = Jτnl, a ; τm
K

Γ ⊢ P′ ∼ Q′ → C′

′

Γ ⊢ let x = d(y) in P else P ∼ let x = d(y) in Q else Q ′ → C ′
Γ ⊢P ∼Q →C
Γ ⊢ if M =

M′

Γ ⊢ P′ ∼ Q′ → C′
then P else

P′

Γ ⊢ M ∼ N : LL → c

∼ if N =

N′

then Q else

Q′

′

′′

(PLetLR)

Γ ⊢ M ′ ∼ N ′ : LL → c ′
(PIfL)

→ C ∪ C ′ ∪∀ (c ∪ c ′ )
′′′

l, 1
l ,1
l ,1
Γ ⊢ M 1 ∼ N 1 : Jτm
; τnl , 1 K → ∅
Γ ⊢ M 2 ∼ N 2 : Jτm
K→∅
′ ; τn ′
′′
′
′′′
l, 1 ? l , 1
l ,1 ? l ,1
′
b = (τm = τm′ )
b = (τn = τn′ )
Γ ⊢ Pb ∼ Qb ′ → C

Γ ⊢ if M 1 = M 2 then P⊤ else P⊥ ∼ if N 1 = N 2 then Q ⊤ else Q ⊥ → C
Γ ⊢ P′ ∼ Q′ → C′

Γ ⊢ M ′ ∼ N ′ : HH → c ′

Γ ⊢ M ∼ N : LL → c

′

′

(PIfS)

Γ ⊢ if M = M then P else P ∼ if N = N then Q else Q ′ → C ′
′

l, ∞
Γ ⊢ M 1 ∼ N 1 : Jτm
; τnl , ∞ K → ∅
Γ ⊢P ∼Q →C

′

′

l, ∞
Γ ⊢ M 2 ∼ N 2 : Jτm
; τnl , ∞ K → ∅
′
′
′
Γ ⊢P ∼Q →C

Γ ⊢ if M 1 = M 2 then P else P ′ ∼ if N 1 = N 2 then Q else Q ′ → C ∪ C ′
Γ ⊢P ∼Q →C
Γ ⊢ P′ ∼ Q′ → C′
Γ ⊢ M ∼ N : LL → c
Γ ⊢ t ∼ t : LL → c ′
t ∈K ∪N ∪C
Γ ⊢ if M = t then P else P ′ ∼ if N = t then Q else Q ′ → C ∪ C ′
Γ ⊢ P′ ∼ Q′ → C′

(PIfLR)

Γ ⊢ M ∼ N : T ∗T′ → c

(PIfLR*)

(PIfP)

′

l, a
Γ ⊢ M ′ ∼ N ′ : Jτm
; τnl , a K → ∅

Γ ⊢ if M = M ′ then P else P ′ ∼ if N = N ′ then Q else Q ′ → C ′
′

′′

′

′′′

(PIfI)

′

l, a
l ,a
Γ ⊢ M 1 ∼ N 1 : Jτm
; τnl , a K → ∅
Γ ⊢ M 2 ∼ N 2 : Jτm
; τnl ′ , a K → ∅
′
l ′′′, a ′
l, a
l ′′, a ′ l ′, a
′
′
Γ ⊢P ∼Q →C
τm , τm′ , τn , τn′

Γ ⊢ if M 1 = M 2 then P else P ′ ∼ if N 1 = N 2 then Q else Q ′ → C

(PIfLR’*)

Figure 11: Rules for processes

APPENDIX A TYPING RULES AND DEFINITIONS
We give on Figures 11 and 12 a complete version of our typing rules for processes, as well as the formal deﬁnition of the well-formedness
judgement for typing environments.
In this section, we also provide additional deﬁnitions (or more precise versions of previous deﬁnitions) regarding constraints, and especially their consistency, that the proofs require.
Deﬁnition A.1 (Constraint). A constraint is deﬁned as a couple of messages, separated by the symbol ∼:
u ∼v

[] ⊢ ⋄ (GNil)

Γ ⊢⋄
Γ, n :

Γ ⊢⋄

n ∈ BN
τnl, a

keys(T ) ⊆ dom(Γ)
Γ, x : T ⊢ ⋄

Γ ⊢⋄

(GNonce)

⊢⋄

keys(T ) ⊆ dom(Γ)
Γ, k : keyl (T ) ⊢ ⋄

(GVar)
(GKey)

Figure 12: Well-formedness of the typing environment
We will consider sets of constraints, which we usually denote c. We will also consider couples (c, Γ) composed of such a set, and a typing
environment Γ. Finally we will denote sets of such tuples C, and call them constraint sets.
Deﬁnition A.2 (Compatible environments). We say that two typing environments Γ, Γ ′ are compatible if they are equal on the intersection
of their domains, i.e. if
∀x ∈ dom(Γ) ∩ dom(Γ ′ ). Γ(x) = Γ ′ (x)
Deﬁnition A.3 (Union of environments). Let Γ, Γ ′ be two compatible environments. Their union Γ ∪ Γ ′ is deﬁned by
• dom(Γ ∪ Γ ′ ) = dom(Γ) ∪ dom(Γ ′ )
• ∀x ∈ dom(Γ). (Γ ∪ Γ ′ )(x) = Γ(x)
• ∀x ∈ dom(Γ ′ ). (Γ ∪ Γ ′ )(x) = Γ ′ (x)
Note that this function is well deﬁned since Γ and Γ ′ are assumed to be compatible.
Deﬁnition A.4 (Operations on constraint sets). We deﬁne two operations on constraints.
• the product union of constraint sets:
C∪×C ′ := {(c ∪ c ′, Γ ∪ Γ ′ ) |
(c, Γ) ∈ C ∧ (c ′, Γ ′ ) ∈ C ′ ∧ Γ, Γ ′ are compatible}
• the addition of a set of constraints c ′ to all elements of a constraint set C:
C∪∀c ′ :=C∪× {(c ′, ∅)}

= (c ∪ c ′, Γ) | (c, Γ) ∈ C

Deﬁnition A.5. For any typing environment Γ, we denote by ΓX its restriction to variables, by ΓN, K its restriction to names and keys,
and by EΓ the set of the names it contains, i.e. N ∩ dom(Γ).
Deﬁnition A.6 (Well-typed substitutions). Let Γ be a typing environment, θ, θ ′ two substitutions, and c a set of constraints. We say that θ,
θ ′ are well-typed in Γ, and write ΓN, K ⊢ θ ∼ θ ′ : ΓX → c, if they are ground and
• dom(θ) = dom(θ ′ ) = dom(ΓX ),
• and
∀x ∈ dom(ΓX ), ΓN, K ⊢ θ(x) ∼ θ ′ (x) : Γ(x) → c x
Ð
for some c x such that c = x ∈dom(ΓX ) c x .
Deﬁnition A.7 (LL substitutions). Let Γ be an environment, ϕ, ϕ ′ two substitutions and c a set of constraints. We say that ϕ, ϕ ′ have type
LL in Γ with constraint c, and write Γ ⊢ ϕ ∼ ϕ ′ : LL → c if
• dom(ϕ) = dom(ϕ ′ );
Ð
• for all x ∈ dom(ϕ) there exists c x such that Γ ⊢ ϕ(x) ∼ ϕ ′ (x) : LL → c x and c = x ∈dom(ϕ ) c x .

Deﬁnition A.8 (Frames associated to a set of constraints). If c is a set of constraints, let ϕ l(c) and ϕ r (c) be the frames composed of the
terms respectively on the left and on the right of the ∼ symbol in the constraints of c (in the same order).

Deﬁnition A.9 (Instantiation of constraints). If c is a set of constraints, and σ , σ ′ are two substitutions, let JcKσ , σ ′ be the instantiation of
c by σ on the left and σ ′ on the right, i.e.
JcKσ , σ ′ = {Mσ ∼ N σ ′ | M ∼ N ∈ c}.
Similarly we write for a constraint set C
JCKσ , σ ′ = {(JcKσ , σ ′ , Γ) | (c, Γ) ∈ C }.

Γ the frame containing all the keys k such
Deﬁnition A.10 (Frames associated to environments). If Γ is a typing environment, we denote ϕ LL
LL
that Γ(k) = key (T ) for some T , all the public keys pk(k) and vk(k) for k ∈ dom(Γ), and all the nonces n such that Γ(n) = τnLL, a (for
a ∈ {∞, 1}).

Deﬁnition A.11 (Branches of a type). If T is a type, we write branches(T ) the set of all types T ′ such that T ′ is not a union type, and either
• T = T ′;
• or there exist types T1 ,. . . ,Tk ,T1′ ,. . . ,Tk′′ such that
T = T1 ∨ . . . ∨ Tk ∨ T ∨ T1′ ∨ . . . ∨ Tk′′
Deﬁnition A.12 (Branches of an environment). For a typing environment Γ, we write branches(Γ) the sets of all environments Γ ′ such that
• dom(Γ ′ ) = dom(Γ)
• ∀x ∈ dom(Γ). Γ ′ (x) ∈ branches(Γ(x)).
Deﬁnition A.13 (Consistency). We say that c is consistent in a typing environment Γ, if for any subsets c ′ ⊆ c and Γ ′ ⊆ Γ such that
′
′
′
′
Γ
′
N, K = ΓN, K and vars(c ) ⊆ dom(Γ ), for any ground substitutions σ , σ well-typed in Γ , the frames new EΓ .(ϕ LL ∪ ϕ l(c )σ ) and
′
′
Γ
new EΓ .(ϕ LL ∪ ϕ r (c )σ ) are statically equivalent.
We say that (c, Γ) is consistent if c is consistent in Γ.
We say that a constraint set C is consistent if each element (c, Γ) ∈ C is consistent.
Γ′

APPENDIX B PROOFS
In this section, we provide the detailed proofs to all of our theorems.
Unless speciﬁed otherwise, the environments Γ considered in the lemmas are implicitly assumed to be well-formed.

B.1

General results and soundness

In this subsection, we prove soundness for non replicated processes, as well as several results regarding the type system that this proof
uses.
Lemma B.1 (Subtyping properties). The following properties of subtyping hold:
(1)
(2)
(3)
(4)
(5)
(6)
(7)
(8)
(9)
(10)
(11)
(12)
(13)
(14)
(15)
(16)
(17)

∀T . HL <: T =⇒ T = HL
∀T . LL <: T =⇒ T = LL ∨ T = HL
∀T . HH <: T =⇒ T = HH ∨ T = HL
∀T1 ,T2 ,T3 . T1 ∗ T2 <: T3 =⇒ T3 = LL ∨ T3 = HL ∨ T3 = HH ∨ (∃T4 ,T5 . T3 = T4 ∗ T5 ) i.e. T3 is LL, HL, HH or a pair type.
∀T ,T1 ,T2 . T <: T1 ∗ T2 =⇒ (∃T1′,T2′ . T = T1′ ∗ T2′ ∧ T1′ <: T1 ∧ T2′ <: T2 )
∀T1 ,T2 . T1 ∗ T2 <: LL =⇒ T1 <: LL ∧ T2 <: LL
∀T1 ,T2 . T1 ∗ T2 <: HH =⇒ T1 <: HH ∨ T2 <: HH
∀T1 ,T2 , k. T1 <: (T2 )k =⇒ (∃T3 <: T2 . T1 = (T3 )k )
∀T1 ,T2 , k. T1 <: {T2 }k =⇒ (∃T3 <: T2 . T1 = {T3 }k )
∀T1 ,T2 , k. (T1 )k <: T2 =⇒ T2 = HL ∨ (∃T3 .T1 <: T3 ∧ T2 = (T3 )k )
∀T1 ,T2 , k. {T1 }k <: T2 =⇒ T2 = HL ∨ (∃T3 .T1 <: T3 ∧ T2 = {T3 }k )
′
′
l, a
l, a
∀T ,m, n, l, l ′ . T <: Jτm
; τnl , a K =⇒ T = Jτm
; τnl , a K
′
′
l, a
l, a
∀T ,m, n, l, l ′ . Jτm
; τnl , a K <: T =⇒ T = HL ∨ T = Jτm
; τnl , a K
∀T1 ,T2 . T1 <: T2 =⇒ neither T1 nor T2 are union types unless T2 = HL or T1 = T2 .
∀T , l,T ′ . T <: keyl (T ′) =⇒ T = keyl (T ′ ).
∀T . T <: LL =⇒ T is a pair type ∨ (∃T ′ . T = keyLL (T ′ )) ∨ T = LL.
∀T . T <: HH =⇒ T is a pair type ∨ (∃T ′ . T = keyHH (T ′ )) ∨ T = HH.

Proof.
• Points 1 to 3 are immediate by induction on the subtyping proof (the proofs of the second and third points use the ﬁrst
one in the STrans case).
• Point 4 is immediate by induction on the proof of T1 ∗ T2 <: T3 (the STrans case uses the ﬁrst three points).
• Point 5 is proved by induction on the proof of T <: T1 ∗ T2 (the STrans case uses the induction hypothesis).
• Points 6 and 7 are proved by induction on the proof of T1 ∗ T2 <: LL (resp. HH; using the previous points in the STrans case).
• Point 8 and 9 immediate by induction on the subtyping proof.
• Points 10 to 13 are proved by induction on the subtyping proof (using the ﬁrst two points in the STrans case).
• Points 14 and 15 are immediate by induction on the subtyping proof.
• Points 16 and 17 are proved by induction on the subtyping proof, using points 5, 8, 9 in the STrans case.


Lemma B.2 (Terms of type T ∨ T ′ ). For all Γ, T , T ′ , for all ground terms t, t ′ , for all c, if
Γ ⊢ t ∼ t′ : T ∨ T ′ → c
then
Γ ⊢ t ∼ t′ : T → c

or

Γ ⊢ t ∼ t′ : T ′ → c

Proof. We prove this property by induction on the derivation of Γ ⊢ t ∼ t ′ : T ∨ T ′ → c.
The last rule of the derivation cannot be TNonce, TNonceL, TCstFN, TPair, TKey, TPubKey, TVKey, TEnc, TEncH, TEncL, TAenc,
TAencH, TSignH, TSignL, THash, THashL, THigh, TLR1 , TLR∞ , TLRVar, TLR’, or TLRL’ since the type in their conclusion cannot be
T ∨ T ′ . It cannot be TVar since t, t ′ are ground.
In the TSub case we know that Γ ⊢ t ∼ t ′ : T ′′ → c (with a shorter derivation) for some T ′′ <: T ∨ T ′ ; thus, by Lemma B.1, T ′′ = T ∨ T ′,
and the claim holds by the induction hypothesis.
Finally in the TOr case, the premise of the rule directly proves the claim.

Lemma B.3 (Terms and branch types). For all Γ, T , c, for all ground terms t, t ′ , if
Γ ⊢ t ∼ t′ : T → c
then there exists T ′ ∈ branches(T ) such that
Γ ⊢ t ∼ t′ : T ′ → c
Proof. This property is a corollary of Lemma B.2. We indeed prove it by successively applying this lemma to Γ ⊢ t ∼ t ′ : T → c until T
is not a union type.

Lemma B.4 (Substitutions type in a branch). For all Γ, c, for all ground substitutions σ , σ ′ , if
ΓN, K ⊢ σ ∼ σ ′ : ΓX → c
then there exists Γ ′ ∈ branches(Γ) such that
Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c
Ð
Proof. This property follows from Lemma B.3. Indeed, by deﬁnition, c = x ∈dom(Γ) c x for some c x such that for all x ∈ dom(Γ)(=
′
dom(σ ) = dom(σ )),
Γ ⊢ σ (x) ∼ σ ′ (x) : Γ(x) → c x
Hence by applying Lemma B.3 we obtain a type Tx ∈ branches(Γ(x)) such that
Γ ⊢ σ (x) ∼ σ ′ (x) : Tx → c x
Thus if we denote Γ ′′ by ∀x ∈ dom(ΓX ).Γ ′′ (x) = Tx , and Γ ′ = ΓN, K ∪ Γ ′′ , we have Γ ′ ∈ branches(Γ) and Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c.



Lemma B.5 (Typing terms in branches). For all Γ, T , c, for all terms t, t ′ , for all Γ ′ ∈ branches(Γ), if Γ ⊢ t ∼ t ′ : T → c then
Γ ′ ⊢ t ∼ t ′ : T → c.
Corollary: in that case, there exists T ′ ∈ branches(T ) such that Γ ′ ⊢ t ∼ t ′ : T ′ → c.
Proof. We prove this property by induction on the derivation of Γ ⊢ t ∼ t ′ : T → c. In most cases for the last rule applied, Γ(x) is
not directly involved in the premises, for any variable x. Rather, Γ appears only in other typing judgements, or is used in Γ(k) or Γ(n) for
some key k or nonce n, and keys or nonces cannot have union types. Hence, since the typing rules for terms do not change Γ, the claim
directly follows from the induction hypothesis. For instance in the TPair case, we have t = ht 1 , t 2 i, t ′ = ht 1′ , t 2′ i, T = T1 ∗ T2 , c = c 1 ∪ c 2 ,
Γ ⊢ t 1 ∼ t 1′ : T1 → c 1 , and Γ ⊢ t 2 ∼ t 2′ : T2 → c 2 . Thus by the induction hypothesis, Γ ′ ⊢ t 1 ∼ t 1′ : T1 → c 1 , and Γ ′ ⊢ t 2 ∼ t 2′ : T2 → c 2 ;
and therefore by rule TPair, Γ ′ ⊢ t ∼ t ′ : T → c. The cases of rules TEnc, TEncH, TEncL, TAenc, TAencH, TAencL, THashL, TSignH,
TSignL, TLR’, TLRL’, TLRVar, TSub, TOr are similar.
The cases of rules TNonce, TNonceL, TCst, TKey, TPubKey, TVKey, THash, THigh, TLR1 , and TLR∞ are immediate since these rules
use neither Γ nor another typing judgement in their premise.
Finally, in the TVar case, t = t ′ = x for some variable x such that Γ(x) = T , and c = ∅. Rule TVar also proves that Γ ′ ⊢ x ∼ x : Γ ′ (x) → ∅.
Since Γ ′ (x) ∈ branches(Γ(x)), by applying rule TOr as many times as necessary, we have Γ ′ ⊢ x ∼ x : Γ(x) → ∅, i.e. Γ ′ ⊢ x ∼ x : T → ∅,
which proves the claim.
The corollary then follows, again by induction on the typing derivation. If T is not a union type, branches(T ) = {T } and the claim is
directly the previous property. Otherwise, the last rule applied in the typing derivation can only be TVar, TSub, or TOr. The TSub case
follows trivially from the induction hypothesis; since T is a union type, it is its own only subtype. In the TVar case, t = t ′ = x for some
variable x such that Γ(x) = T . Hence, by deﬁnition, Γ ′ (x) ∈ branches(T ), and by rule TVar we have Γ ′ ⊢ t ∼ t ′ : Γ ′ (x) → c. Finally, in the
TOr case, we have T = T1 ∨ T2 for some T1 , T2 such that Γ ⊢ t ∼ t ′ : T1 → c. By the induction hypothesis, there exists T1′ ∈ branches(T1 )
such that Γ ′ ⊢ t ∼ t ′ : T1′ → c. Since, by deﬁnition, branches(T1 ) ⊆ branches(T1 ∨ T2 ), this proves the claim.


Lemma B.6 (Typing destructors in branches). For all Γ, T , d, x, for all Γ ′ ∈ branches(Γ), if Γ ⊢ d(x) : T then Γ ′ ⊢ d(x) : T .
Proof. This property is immediate by examining the typing rules for destructors. Indeed, Γ and Γ ′ only diﬀer on variables, and the rules
for destructors only involve Γ(x) for x ∈ X in conditions of the form Γ(x) = T for some type T which is not a union type.
Hence in these cases Γ ′ (x) is also T , and the same rule can be applied to Γ ′ to prove the claim.

Lemma B.7 (Typing processes in branches). For all Γ,C, for all processes P, Q, for all Γ ′ ∈ branches(Γ), if Γ ⊢ P ∼ Q → C then there
exists C ′ ⊆ C such that Γ ′ ⊢ P ∼ Q → C ′.
Proof. We prove this lemma by induction on the derivation of Γ ⊢ P ∼ Q → C. In all the cases for the last rule applied in this derivation,
we can show that the conditions of this rule still hold in Γ ′ (instead of Γ) using
• Lemma B.5 for the conditions of the form Γ ⊢ M ∼ N : T → c;
• Lemma B.6 for the conditions of the form Γ ⊢ d(y) : T ;
′
l, a
• the fact that if Γ(x) is not a union type,then Γ ′ (x) = Γ(x), for conditions such as "Γ(x) = LL", "Γ(x) = Jτm
; τnl , a K" (in the PLetLR
case);
• the induction hypothesis for the conditions of the form Γ ⊢ P ′ ∼ Q ′ → C ′′. In this case, the induction hypothesis produces a
C ′′′ ⊆ C ′′, which can then be used to show C ′ ⊆ C, since C ′ and C are usually respectively C ′′′ and C ′′ with some terms added.
We detail here the cases of rules POut, PPar, and POr. The other cases are similar, as explained above.
If the last rule is POut, then we have P = out(M).P ′ , Q = out(N ).Q ′, C = C ′′∪∀c for some P ′ , Q ′ , M, N , C ′′, c, such that Γ ⊢ P ′ ∼
Q ′ → C ′′ and Γ ⊢ M ∼ N : LL → c. Hence by Lemma B.5, Γ ′ ⊢ M ∼ N : LL → c, and by the induction hypothesis applied to P ′ , Q ′,
Γ ′ ⊢ P ′ ∼ Q ′ → C ′′′ for some C ′′′ such that C ′′′ ⊆ C ′′ . Therefore by rule POut, Γ ′ ⊢ P ∼ Q → C ′′′ ∪∀c, and since C ′′′ ∪∀c ⊆ C ′′ ∪∀c(= C),
this proves the claim.
If the last rule is PPar, then we have P = P1 | P2 , Q = Q 1 | Q 2 , C = C 1 ∪×C 2 for some P1 , P2 , Q 1 , Q 2 , C 1 , C 2 such that Γ ⊢ P1 ∼ Q 1 → C 1
and Γ ⊢ P2 ∼ Q 2 → C 2 . Thus by applying the induction hypothesis twice, we have Γ ′ ⊢ P1 ∼ Q 1 → C 1′ and Γ ′ ⊢ P2 ∼ Q 2 → C 2′ with
C 1′ ⊆ C 1 and C 2′ ⊆ C 2 . Therefore by rule PPar, Γ ′ ⊢ P1 | P2 ∼ Q 1 | Q 2 → C 1′ ∪×C 2′ , and since C 1′ ∪×C 2′ ⊆ C 1 ∪×C 2 (= C), this proves the claim.
If the last rule is POr, then there exist Γ ′′ , x, T1 , T2 , C 1 and C 2 such that Γ = Γ ′′ , x : T1 ∨ T2 , C = C 1 ∪ C 2 , Γ ′′ , x : T1 ⊢ P ∼ Q → C 1
and Γ ′′, x : T2 ⊢ P ∼ Q → C 2 . By deﬁnition of branches, it is clear that branches(Γ) = branches(Γ ′′ , x : T1 ∨ T2 ) = branches(Γ ′′ , x : T1 ) ∪
branches(Γ ′′ , x : T2 ). Thus, since Γ ′ ∈ branches(Γ), we know that Γ ′ ∈ branches(Γ ′′ , x : T1 ) or Γ ′ ∈ branches(Γ ′′ , x : T2 ). We write the proof
for the case where Γ ′ ∈ branches(Γ ′′ , x : T1 ), the other case is analogous. By applying the induction hypothesis to Γ ′′ , x : T1 ⊢ P ∼ Q → C 1 ,
there exists C 1′ ⊆ C 1 such that Γ ′ ⊢ P ∼ Q → C 1′ . Since C 1 ⊆ C, this proves the claim.

Lemma B.8 (Environments in the constraints). For all Γ,C, for all processes P, Q, if
Γ ⊢P ∼Q →C
then for

all (c, Γ ′ )

∈ C,

dom(Γ ′ ) ⊆ dom(Γ) ∪ bvars(P) ∪ bvars(Q) ∪ nnames(P) ∪ nnames(Q)
(where bvars(P), nnames(P) respectively denote the sets of bound variables and names in P).
Proof. We prove this lemma by induction on the typing derivation of Γ ⊢ P ∼ Q → C.
If the last rule applied in this derivation is PZero, we have C = {(∅, Γ)}, and the claim clearly holds.
In the PPar case, we have P = P1 | P2 , Q = Q 1 | Q 2 , and C = C 1 ∪×C 2 for some P1 , P2 , Q 1 , Q 2 , C 1 , C 2 such that Γ ⊢ P1 ∼ Q 1 → C 1 and
Γ ⊢ P2 ∼ Q 2 → C 2 . Thus any element of C is of the form (c 1 ∪ c 2 , Γ1 ∪ Γ2 ) where (c 1 , Γ1 ) ∈ C 1 , (c 2 , Γ2 ) ∈ C 2 , and Γ1 , Γ2 are compatible.
By the induction hypothesis, dom(Γ1 ) ⊆ dom(Γ) ∪ bvars(P1 ) ∪ bvars(Q 1 ) ∪ nnames(P1 ) ∪ nnames(Q 1 ) ⊆ dom(Γ) ∪ bvars(P) ∪ bvars(Q) ∪
nnames(P) ∪ nnames(Q), and similarly for Γ2 . Therefore, since dom(Γ1 ∪ Γ2 ) = dom(Γ1 ) ∪ dom(Γ2 ) (by deﬁnition), the claim holds.
In the PIn and PLet cases, the typing judgement appearing in the condition of the rule uses Γ extended with an additional variable,
which is bound in P and Q. We detail the PIn case, the other case is similar. We have P = in(x).P ′ , Q = in(x).Q ′ for some x, P ′ , Q ′ such
that x < dom(Γ) and Γ, x : LL ⊢ P ′ ∼ Q ′ → C. Hence by the induction hypothesis, if (c, Γ ′ ) ∈ C, dom(Γ ′ ) ⊆ dom(Γ, x : LL) ∪ bvars(P ′ ) ∪
bvars(Q ′ ) ∪ nnames(P ′ ) ∪ nnames(Q ′ ). Since bvars(P) = {x } ∪ bvars(P ′ ) and bvars(Q) = {x } ∪ bvars(Q ′ ), this proves the claim.
The case of rule PNew is similar, extending Γ with a nonce instead of a variable.
In the POut case, there exist P ′ , Q ′ , M, N , C ′, c such that P = out(M).P ′ , Q = out(N ).Q ′, C = C ′∪∀c, Γ ⊢ M ∼ N : LL → c and
Γ ⊢ P ′ ∼ Q ′ → C ′. If (c ′, Γ ′ ) ∈ C, by deﬁnition of ∪∀ there exists c ′′ such that (c ′′, Γ ′ ) ∈ C ′ and c ′ = c ∪ c ′′ . By the induction hypothesis,
we thus have
dom(Γ ′ ) ⊆ dom(Γ) ∪ bvars(P ′ ) ∪ bvars(Q ′ ) ∪ nnames(P ′ ) ∪ nnames(Q ′ )
′
and since bvars(P ) = bvars(P), nnames(P ′ ) = nnames(P), and similarly for Q, this proves the claim.
In the PIfL case, there exist P ′ , P ′′ , Q ′ , Q ′′ , M, N , M ′ , N ′, C ′, C ′′, c, c ′ such that P = if M = M ′ then P ′ else P ′′ , Q = if N =
N ′ then Q ′ else Q ′′ , C = (C ′ ∪ C ′′)∪∀ (c ∪ c ′), Γ ⊢ M ∼ N : LL → c, Γ ⊢ M ′ ∼ N ′ : LL → c ′, Γ ⊢ P ′ ∼ Q ′ → C ′, and Γ ⊢ P ′′ ∼ Q ′′ → C ′′.

If (c ′′, Γ ′ ) ∈ C, by deﬁnition of ∪∀ there exist c ′′′ , such that (c ′′′, Γ ′ ) ∈ C ′ ∪ C ′′ and c ′′ = c ′′′ ∪ c ∪ c ′ . We write the proof for the case where
(c ′′′ , Γ ′ ) ∈ C ′, the other case is analogous. By the induction hypothesis, we thus have
dom(Γ ′ ) ⊆ dom(Γ) ∪ bvars(P ′ ) ∪ bvars(Q ′ ) ∪ nnames(P ′ ) ∪ nnames(Q ′ )
and since bvars(P ′ ) ⊆ bvars(P), nnames(P ′ ) ⊆ nnames(P), and similarly for Q, this proves the claim.
The cases of rules POr, PLetLR, PIfLR, PIfS, PIfLR*, PIfP, PIfI, and PIfLR’* remain. All these cases are similar, we write the proof for
the PIfLR* case. In this case, there exist P ′ , P ′′ , Q ′, Q ′′ , M, N , M ′ , N ′, C ′, C ′′, l, l ′, m, n such that P = if M = M ′ then P ′ else P ′′ ,
′
′
l, ∞
l, ∞
Q = if N = N ′ then Q ′ else Q ′′ , C = C ′ ∪ C ′′ , Γ ⊢ M ∼ N : Jτm
; τnl , ∞ K → ∅, Γ ⊢ M ′ ∼ N ′ : Jτm
; τnl , ∞ K → ∅, Γ ⊢ P ′ ∼ Q ′ → C ′, and
Γ ⊢ P ′′ ∼ Q ′′ → C ′′. If (c, Γ ′ ) ∈ C, we thus know that (c, Γ ′ ) ∈ C ′ or (c, Γ ′ ) ∈ C ′′. We write the proof for the case where (c, Γ ′ ) ∈ C ′, the
other case is analogous. By the induction hypothesis, we thus have
dom(Γ ′ ) ⊆ dom(Γ) ∪ bvars(P ′ ) ∪ bvars(Q ′ ) ∪ nnames(P ′ ) ∪ nnames(Q ′ )
and since bvars(P ′ ) ⊆ bvars(P), nnames(P ′ ) ⊆ nnames(P), and similarly for Q, this proves the claim.



Lemma B.9 (Environments in the constraints do not contain union types). For all Γ,C, for all processes P, Q, if
Γ ⊢P ∼Q →C
then for all (c, Γ ′ ) ∈ C,
branches(Γ ′ ) = {Γ ′ }
i.e. for all x ∈ dom(Γ ′ ), Γ ′ (x) is not a union type.
Proof. This property is immediate by induction on the typing derivation.


Γ ′ , P, Q, C, c, t, t ′ , T , c, if Γ

⋄ and Γ ∪ Γ ′

Lemma B.10 (Typing is preserved by extending the environment). For all Γ,
⊢
⊢ ⋄ (we do not
require that Γ ′ is well-formed):
• if dom(Γ) ∩ dom(Γ ′ ) = ∅, and if Γ ⊢ t ∼ t ′ : T → c, then Γ ∪ Γ ′ ⊢ t ∼ t ′ : T → c.
• if dom(Γ) ∩ dom(Γ ′ ) = ∅, and if Γ ⊢ d(y) : T , then Γ ∪ Γ ′ ⊢ d(y) : T .
• if (dom(Γ) ∪ bvars(P) ∪ bvars(Q) ∪ nnames(P) ∪ nnames(Q)) ∩ dom(Γ ′ ) = ∅, and if Γ ⊢ P ∼ Q → C, then Γ ∪ Γ ′ ⊢ P ∼ Q → C ′.
where C ′ = {(c, Γc ∪ Γ ′′ )|(c, Γc ) ∈ C ∧ Γ ′′ ∈ branches(Γ ′ )} (note that the union is well deﬁned, i.e. Γc and Γ ′′ are compatible, thanks to
Lemma B.8)
Proof.
• The ﬁrst point is immediate by induction on the type derivation.
• The second point is immediate by examining the typing rules for destructors.
• The third point is immediate by induction on the type derivation of the processes. In the PZero case, to satisfy the condition that
the environment is its own only branch, rule POr needs to be applied ﬁrst, in order to split all the union types in Γ ′ , which yields
the environments branches(Γ ∪ Γ ′ ) in the constraints.

Lemma B.11 (Consistency for Subsets). The following statements about constraints hold:
(1) If (c, Γ) is consistent, and c ′ ⊆ c then (c ′, Γ) is consistent.
(2) Let C be a consistent constraint set. Then every subset C ′ ⊆ C is also consistent.
(3) If C∪∀c ′ is consistent then C also is.
(4) If C 1 ⊆ C 2 and C 1′ ⊆ C 2′ , then C 1 ∪×C 1′ ⊆ C 2 ∪×C 2′ .
(5) J·Kσ , σ ′ commutes with ∪, ∪× , ∪∀ , i.e. for all C, C ′, σ , σ ′ , JC∪×C ′Kσ , σ ′ = JCKσ , σ ′ ∪× JC ′Kσ , σ ′ and similarly for ∪, ∪∀ .
q
y
(6) If σ1 and σ1′ are ground and have disjoint domains, as well as σ2 and σ2′ , then for all c, JcKσ1, σ2 σ ′, σ ′ = JcKσ1 ∪σ ′, σ2 ∪σ ′
1

2

1

(7) if C is consistent, if ΓN, K ⊢ σ ∼ σ ′ : ΓX → c for some c, and if for all (c ′, Γ ′ ) ∈ C, Γ ⊆ Γ ′ , then JCKσ , σ ′ is consistent.

2

Proof. Points 1 and 2 follow immediately from the deﬁnition of consistency and of static equivalence.
Point 3 follows from the point 1: for every (c, Γ) ∈ C, (c ∪ c ′, Γ) is in C∪∀c ′; which is consistent since C∪∀c ′ is; therefore (c, Γ) also is.
Point 4 follows from the deﬁnition of ∪× . If (c, Γ) ∈ C 1 ∪×C 1′ , there exists (c 1 , Γ1 ) ∈ C 1 , (c 1′ , Γ1′ ) ∈ C 1′ such that (c, Γ) = (c 1 ∪ c 1′ , Γ1 ∪ Γ1′ )
(and Γ1 , Γ1′ are compatible). Since C 1 ⊆ C 2 , (c 1 , Γ1 ) ∈ C 2 . Similarly, (c 1′ , Γ1′ ) ∈ C 2′ . Therefore (c, Γ) ∈ C 2 ∪×C 2′ .
Points 5 and 6 follow from the deﬁnitions of J·Kσ , σ ′ , ∪× , ∪∀ .

Point 7 follows from the deﬁnitions of J·Kσ , σ ′ , and of consistency. Indeed, let (c ′′ , Γ ′′ ) ∈ JCKσ , σ ′ . There exists c ′′′ such that c ′′ = Jc ′′′ Kσ , σ ′ ,
and (c ′′′ , Γ ′′ ) ∈ C. Let c 1 ⊆ c ′′ and Γ1 ⊆ Γ ′′ such that Γ1 N, K = Γ ′′ N, K and vars(c 1 ) ⊆ dom(Γ1 ). Let θ, θ ′ be well-typed in Γ1 . Since
c ′′ = Jc ′′′ Kσ , σ ′ , there exists c 2 ⊆ c ′′′ such that c 1 = Jc 2 Kσ , σ ′ . If we show that σθ and σ ′θ ′ are well-typed in Γ1 ∪ Γ, it will follow from the
Γ2
Γ2
consistency of C that new EΓ2 .(ϕ LL
∪ ϕ l(c 2 )σθ) and new EΓ2 .(ϕ LL
∪ ϕ r (c 2 )σ ′θ ′ ) are statically equivalent, where Γ2 = Γ1 ∪ Γ ⊆ Γ ′′ . Since
Γ1
Γ2
Γ1
Γ1
Γ1 N, K = Γ ′′ N, K and Γ ⊆ Γ ′′ , we have EΓ2 = EΓ1 , and ϕ LL
∪ ϕ r (c 1 )θ ′ ) are statically
= ϕ LL
. Hence new EΓ1 .(ϕ LL
∪ ϕ l(c 1 )θ) and new EΓ1 .(ϕ LL
equivalent,

It only remains to be proved that σθ and σ ′θ ′ are well-typed in Γ2 .
Since σ is ground, σθ = σ ∪ θ |dom(Γ1 )\dom(Γ) , and similarly for σ ′θ ′ . Hence, since σ , σ ′ are well-typed in Γ, and θ, θ ′ are well-typed in Γ1 ,
their compositions also are, which concludes the proof.

Lemma B.12 (Environments in constraints contain a branch of the typing environment). For all Γ, C, for all processes P, Q, if
Γ ⊢ P ∼ Q → C then for all (c, Γ ′ ) ∈ C, there exists Γ ′′ ∈ branches(Γ) such that Γ ′′ ⊆ Γ ′ .
Proof. We prove this property by induction on the type derivation of Γ ⊢ P ∼ Q → C. In the PZero case, C = {(∅, Γ)}, and by assumption
branches(Γ) = {Γ}, hence the claim trivially holds.
In the PPar case, we have P = P1 | P2 , Q = Q 1 | Q 2 , and C = C 1 ∪×C 2 for some P1 , P2 , Q 1 , Q 2 , C 1 , C 2 such that Γ ⊢ P1 ∼ Q 1 → C 1 and
Γ ⊢ P2 ∼ Q 2 → C 2 . Thus any element of C is of the form (c 1 ∪ c 2 , Γ1 ∪ Γ2 ) where (c 1 , Γ1 ) ∈ C 1 , (c 2 , Γ2 ) ∈ C 2 , and Γ1 , Γ2 are compatible. By the
induction hypothesis, both C 1 and C 2 contain a branch of Γ. The claim holds, as these are necessarily the same branch, since Γ1 and Γ2 are
compatible.
In the POr case, we have Γ = Γ ′′, x : T1 ∨ T2 for some x, Γ ′′ , T1 , T2 such that Γ ′′ , x : T1 ⊢ P ∼ Q → C 1 and Γ ′′ , x : T2 ⊢ P ∼ Q → C 2 , and
C = C 1 ∪C 2 . Thus by the induction hypothesis, if (c, Γ ′ ) ∈ Ci (for i ∈ {1, 2}), then Γ ′ contains some Γ ′′′ ∈ branches(Γ ′′ , x : Ti ) ⊆ branches(Γ),
and the claim holds.
In the POut case, there exist P ′ , Q ′ , M, N , C ′, c such that P = out(M).P ′ , Q = out(N ).Q ′, C = C ′∪∀c, Γ ⊢ M ∼ N : LL → c and
Γ ⊢ P ′ ∼ Q ′ → C ′. If (c ′, Γ ′ ) ∈ C, by deﬁnition of ∪∀ there exists c ′′ such that (c ′′, Γ ′ ) ∈ C ′ and c ′ = c ∪c ′′ . Hence by applying the induction
hypothesis to Γ ⊢ P ′ ∼ Q ′ → C ′, there exists Γ ′′ ∈ branches(Γ) such that Γ ′′ ⊆ Γ ′ .
In the PIfL case, there exist P ′ , P ′′ , Q ′ , Q ′′ , M, N , M ′ , N ′, C ′, C ′′, c, c ′ such that P = if M = M ′ then P ′ else P ′′ , Q = if N =
then Q ′ else Q ′′ , C = (C ′ ∪ C ′′)∪∀ (c ∪ c ′), Γ ⊢ M ∼ N : LL → c, Γ ⊢ M ′ ∼ N ′ : LL → c ′, Γ ⊢ P ′ ∼ Q ′ → C ′, and Γ ⊢ P ′′ ∼ Q ′′ → C ′′.
If (c ′′, Γ ′ ) ∈ C, by deﬁnition of ∪∀ there exist c ′′′ , such that (c ′′′, Γ ′ ) ∈ C ′ ∪ C ′′ and c ′′ = c ′′′ ∪ c ∪ c ′ . We write the proof for the case where
(c ′′′ , Γ ′ ) ∈ C ′, the other case is analogous. By applying the induction hypothesis to Γ ⊢ P ′ ∼ Q ′ → C ′, there exists Γ ′′ ∈ branches(Γ) such
that Γ ′′ ⊆ Γ ′ , which proves the claim.
N′

All remaining cases are similar. We write the proof for the PIfLR* case. In this case, there exist P ′ , P ′′ , Q ′, Q ′′ , M, N , M ′ , N ′ , C ′, C ′′, l,
′
l, ∞
such that P = if M = M ′ then P ′ else P ′′ , Q = if N = N ′ then Q ′ else Q ′′ , C = C ′ ∪ C ′′, Γ ⊢ M ∼ N : Jτm
; τnl , ∞ K → ∅,
′
l, ∞
Γ ⊢ M ′ ∼ N ′ : Jτm
; τnl , ∞ K → ∅, Γ ⊢ P ′ ∼ Q ′ → C ′, and Γ ⊢ P ′′ ∼ Q ′′ → C ′′ . If (c, Γ ′ ) ∈ C, we thus know that (c, Γ ′ ) ∈ C ′ or (c, Γ ′ ) ∈ C ′′.
We write the proof for the case where (c, Γ ′ ) ∈ C ′, the other case is analogous. By applying the induction hypothesis to Γ ⊢ P ′ ∼ Q ′ → C ′,
there exists Γ ′′ ∈ branches(Γ) such that Γ ′′ ⊆ Γ ′ , which proves the claim.

l ′, m, n

Lemma B.13 (All branches are represented in the constraints). For all Γ, ∆, C, for all processes P, Q, if Γ ⊢ P ∼ Q → C then for all
Γ ′ ∈ branches(Γ), there exists (c, Γ ′′ ) ∈ C, such that Γ ′ ⊆ Γ ′′ .
Proof. We prove this property by induction on the type derivation of Γ ⊢ P ∼ Q → C. In the PZero case, C = {(∅, Γ)}, and by assumption
branches(Γ) = {Γ}, hence the claim trivially holds.
In the PPar case, we have P = P1 | P2 , Q = Q 1 | Q 2 , and C = C 1 ∪×C 2 for some P1 , P2 , Q 1 , Q 2 , C 1 , C 2 such that Γ ⊢ P1 ∼ Q 1 → C 1 and
Γ ⊢ P2 ∼ Q 2 → C 2 . By the induction hypothesis, there exists (c 1 , Γ1 ) ∈ C 1 and (c 2 , Γ2 ) ∈ C 2 such that Γ ′ ⊆ Γ1 and Γ ′ ⊆ Γ2 . By Lemma B.8,
dom(Γ1 ) and dom(Γ2 ) only contain dom(Γ)(= dom(Γ ′ )) and variables and names in bvars(P1 ) ∪ bvars(Q 1 ) ∪ nnames(P1 ) ∪ nnames(Q 1 )
and bvars(P2 ) ∪ bvars(Q 2 ) ∪ nnames(P2 ) ∪ nnames(Q 2 ) respectively. Since Γ1 (x) = Γ2 (x) = Γ ′ (x) for all x ∈ dom(Γ ′ ), and since the sets
bvars(P1 ) ∪ bvars(Q 1 ) ∪ nnames(P1 ) ∪ nnames(Q 1 ) and bvars(P2 ) ∪ bvars(Q 2 ) ∪ nnames(P2 ) ∪ nnames(Q 2 ) are disjoint by well formedness
of the processes P1 | P2 and Q 1 | Q 2 , Γ1 and Γ2 are compatible. Thus (c 1 ∪ c 2 , Γ1 ∪ Γ2 ) ∈ C 1 ∪×C 2 (= C), and the claim holds since Γ ′ ⊆ Γ1 ∪ Γ2 .
In the POr case, we have Γ = Γ ′′ , x : T1 ∨ T2 for some x, Γ ′′ , T1 , T2 such that Γ ′′ , x : T1 ⊢ P ∼ Q → C 1 and Γ ′′, x : T2 ⊢ P ∼ Q → C 2 ,
and C = C 1 ∪ C 2 . Since branches(Γ) = branches(Γ ′′, x : T1 ) ∪ branches(Γ ′′ , x : T2 ), we know that Γ ′ ∈ branches(Γ ′′, x : Ti ) for some i. We
conclude this case directly by applying the induction hypothesis to Γ ′′ , x : Ti ⊢ P ∼ Q → Ci .
In the POut case, there exist P ′ , Q ′ , M, N , C ′, c such that P = out(M).P ′ , Q = out(N ).Q ′, C = C ′∪∀c, Γ ⊢ M ∼ N : LL → c and
Γ ⊢ P ′ ∼ Q ′ → C ′. By applying the induction hypothesis to Γ ⊢ P ′ ∼ Q ′ → C ′, there exists (c ′′ , Γ ′′ ) ∈ C ′ such that Γ ′ ⊆ Γ ′′ . By deﬁnition
of ∪∀ , (c ′′ ∪ c, Γ ′′ ) ∈ C, which proves the claim.
In the PIfL case, there exist P ′ , P ′′ , Q ′ , Q ′′ , M, N , M ′ , N ′, C ′, C ′′, c, c ′ such that P = if M = M ′ then P ′ else P ′′ , Q = if N =
then Q ′ else Q ′′ , C = (C ′ ∪C ′′ )∪∀ (c ∪c ′ ), Γ ⊢ M ∼ N : LL → c, Γ ⊢ M ′ ∼ N ′ : LL → c ′ , Γ ⊢ P ′ ∼ Q ′ → C ′, and Γ ⊢ P ′′ ∼ Q ′′ → C ′′. By
applying the induction hypothesis to Γ ⊢ P ′ ∼ Q ′ → C ′, there exists (c ′′, Γ ′′ ) ∈ C ′ such that Γ ′ ⊆ Γ ′′ . By deﬁnition of ∪∀ , (c ′′ ∪c∪c ′, Γ ′′ ) ∈ C,
which proves the claim.
N′

All remaining cases are similar. We write the proof for the PIfLR* case. In this case, there exist P ′ , P ′′ , Q ′, Q ′′ , M, N , M ′ , N ′ , C ′, C ′′, l,
′
l, ∞
l ′, m, n such that P = if M = M ′ then P ′ else P ′′ , Q = if N = N ′ then Q ′ else Q ′′ , C = C ′ ∪ C ′′, Γ ⊢ M ∼ N : Jτm
; τnl , ∞ K → ∅,
′
l, ∞
Γ ⊢ M ′ ∼ N ′ : Jτm
; τnl , ∞ K → ∅, Γ ⊢ P ′ ∼ Q ′ → C ′, and Γ ⊢ P ′′ ∼ Q ′′ → C ′′ . By applying the induction hypothesis to Γ ⊢ P ′ ∼ Q ′ → C ′,
there exists (c ′′, Γ ′′ ) ∈ C ′ such that Γ ′ ⊆ Γ ′′ .

If (c, Γ ′ ) ∈ C, we thus know that (c, Γ ′ ) ∈ C ′ or (c, Γ ′ ) ∈ C ′′. We write the proof for the case where (c, Γ ′ ) ∈ C ′, the other case is analogous.
By applying the induction hypothesis to Γ ⊢ P ′ ∼ Q ′ → C ′, there exists Γ ′′ ∈ branches(Γ) such that Γ ′′ ⊆ Γ ′ , which proves the claim.

′

l, a
Lemma B.14 (Refinement types). For all Γ, for all terms t, t ′ , for all m, n, a, l, l ′, c, if Γ ⊢ t ∼ t ′ : Jτm
; τnl , a K → c then c = ∅ and
′

l, a
• either t = m, t ′ = n, a = ∞ and Γ(m) = τm
and Γ(n) = τnl , a ;
′
l,
a
• or t = m, t ′ = n, a = 1, and (Γ(m) = τm ) ∨ (m ∈ F N ∪ C ∧ l = LL), and (Γ(n) = τnl , a ) ∨ (n ∈ F N ∪ C ∧ l ′ = LL);
′′
′
l, a
l ′′′, a
• or t and t ′ are variables x, y ∈ X and there exist labels l ′′, l ′′′ , and names m ′, n ′ such that Γ(x) = Jτm
; τnl ′ , a K and Γ(y) = Jτm
; τnl , a K.
′
In particular if t, t ′ are ground then only the ﬁrst case can occur.

Proof. The proof of this property is immediate by induction on the typing derivation for the terms. Indeed, because of the form of the
′
l, a
type, and by well-formedness of Γ, the only rules which can lead to Γ ⊢ t ∼ t ′ : Jτm
; τnl , a K → c are TVar, TLR1 , TLR∞ , TLRVar, and
TSub.
In the TVar, TLR1 , TLR∞ cases the claim directly follows from the premises of the rule.
In the TLRVar case, t and t ′ are necessarily variables, and their types in Γ are obtained directly by applying the induction hypothesis to
the premises of the rule.
′
′
l, a
l, a
Finally in the TSub case, Γ ⊢ t ∼ t ′ : T → c and T <: Jτm
; τnl , a K. By Lemma B.1, T = Jτm
; τnl , a K and we conclude by the induction
hypothesis.

Lemma B.15 (Encryption types). For all environment Γ, type T , key k ∈ K, messages M, N , and set of constraints c:
(1) If Γ ⊢ M ∼ N : (T )k → c then
• either there exist M ′ , N ′, such that M = enc(M ′, k), N = enc(N ′, k), and Γ ⊢ M ′ ∼ N ′ : T → c with a shorter derivation (than the
one for Γ ⊢ M ∼ N : (T )k → c);
• or M and N are variables.
(2) If Γ ⊢ M ∼ N : {T }k → c then
• either there exist M ′ , N ′, such that M = aenc(M ′, pk(k)), N = aenc(N ′, pk(k)), and Γ ⊢ M ′ ∼ N ′ : T → c with a shorter derivation
(than the one for Γ ⊢ M ∼ N : {T }k → c);
• or M and N are variables.
(3) If T <: LL and Γ ⊢ enc(M, k) ∼ N : T → c then T = LL.
(4) If T <: LL and Γ ⊢ aenc(M, pk(k)) ∼ N : T → c then T = LL.
(5) If Γ ⊢ enc(M, k) ∼ N : LL → c then there exists N ′ such that N = enc(N ′, k), and
• either there exist T ′ and c ′ such that Γ(k) = keyHH (T ′ ), c = {enc(M, k) ∼ N } ∪ c ′ , and Γ ⊢ M ∼ N ′ : T ′ → c ′ ;
• or there exists T ′ such that Γ(k) = keyLL (T ′ ) and Γ ⊢ M ∼ N ′ : LL → c.
(6) If Γ ⊢ aenc(M, pk(k)) ∼ N : LL → c then there exists N ′ such that N = aenc(N ′, pk(k)), and
• either there exist T ′ and c ′ such that Γ(k) = keyHH (T ′ ), c = {aenc(M, pk(k)) ∼ N } ∪ c ′, and Γ ⊢ M ∼ N ′ : T ′ → c ′ ;
• or k ∈ dom(Γ) and Γ ⊢ M ∼ N ′ : LL → c.
(7) The symmetric properties to the previous four points, i.e. when the term on the right is an encryption, also hold.
Proof. We prove point 1 by induction on the derivation of Γ ⊢ M ∼ N : (T )k → c. Because of the form of the type, and by wellformedness of Γ, the only possibilities for the last rule applied are TVar, TEnc, and TSub. The claim clearly holds in the TVar and TEnc
cases. In the TSub case, we have Γ ⊢ M ∼ N : T ′ <: (T )k → c, and by Lemma B.1, there exists T ′′ <: T such that T ′ = (T ′′ )k . Therefore, by
applying the induction hypothesis to Γ ⊢ M ∼ N : T ′ → c
• either M and N are either two variables, and the claim holds;
• or there exist M ′ , N ′ such that M = enc(M ′, k), N = enc(N ′, k), and Γ ⊢ M ′ ∼ N ′ : T ′′ → c, with a derivation shorter than the one
for Γ ⊢ M ∼ N : T ′ → c. Thus by subtyping (rule TSub), Γ ⊢ M ′ ∼ N ′ : T → c with a shorter derivation that Γ ⊢ M ∼ N : (T )k → c,
which proves the property.
Point 2 has a similar proof to point 1.
We now prove point 3 by induction on the proof of Γ ⊢ enc(M, k) ∼ N : T → c. Because of the form of the terms, the last rule applied
can only be THigh, TOr, TEnc, TEncH, TEncL, TAencH, TAencL, TLR’, TLRL’ or TSub.
The THigh, TLR’, TOr, TEnc cases are actually impossible by Lemma B.1, since T <: LL. In the TSub case, we have Γ ⊢ enc(M, k) ∼
N : T ′ → c for some T ′ such that T ′ <: T . By transitivity of <:, T ′ <: LL, and the induction hypothesis proves the claim. In all other cases,
T = LL and the claim holds.
Point 4 has a similar proof to point 3.
We prove point 5 by induction on the proof of Γ ⊢ enc(M, k) ∼ N : LL → c. Because of the form of the terms and of the type (i.e. LL) the
last rule applied can only be TEncH, TEncL, TAencH, TAencL, TLRL’ or TSub.

The TLRL’ case is impossible, since by Lemma B.14 it would imply that enc(M, k) is either a variable or a nonce.
In the TSub case, we have Γ ⊢ enc(M, k) ∼ N : T ′ → c for some T ′ such that T ′ <: LL. By point 3, T ′ = LL, and the premise of the rule
thus gives a shorter derivation of Γ ⊢ enc(M, k) ∼ N : LL → c. The induction hypothesis applied to this shorter derivation proves the claim.
The TAencH and TAencL cases are impossible, since the condition of the rule would then imply Γ ⊢ enc(M, k) ∼ N : {T }k → c ′ for
some T , k, c ′, which is not possible by point 2.
Finally, in the TEncH and TEncL cases, the premises of the rule directly proves the claim.
Point 6 has a similar proof to point 5.
The symmetric properties, as described in point 7, have analogous proofs.



Lemma B.16 (Signature types). For all environment Γ, type T , key k ∈ K, messages M, N , and set of constraints c:
(1) If T <: LL and Γ ⊢ sign(M, k) ∼ N : T → c then T = LL.
(2) If Γ ⊢ sign(M, k) ∼ N : LL → c then there exists N ′ such that N = sign(N ′, k), and
• either there exist T ′ , c ′ and c ′′ such that Γ(k) = keyHH (T ′), c = {sign(M, k) ∼ N } ∪ c ′ ∪ c ′′ , Γ ⊢ M ∼ N ′ : T ′ → c ′, and
Γ ⊢ M ∼ N ′ : LL → c ′′ ;
• or there exists T ′ such that Γ(k) = keyLL (T ′ ) and Γ ⊢ M ∼ N ′ : LL → c.
(3) The symmetric properties to the previous four points, i.e. when the term on the right is a signature, also hold.
Proof. We prove point 1 by induction on the proof of Γ ⊢ sign(M, k) ∼ N : T → c. Because of the form of the terms, the last rule
applied can only be THigh, TOr, TEncH, TEncL, TAencH, TAencL, TSignH, TSignL, TLR’, TLRL’ or TSub.
The THigh, TLR’, TOr cases are actually impossible by Lemma B.1, since T <: LL. In the TSub case, we have Γ ⊢ sign(M, k) ∼ N : T ′ → c
for some T ′ such that T ′ <: T . By transitivity of <:, T ′ <: LL, and the induction hypothesis proves the claim. In all other cases, T = LL and
the claim holds.
We prove point 2 by induction on the proof of Γ ⊢ sign(M, k) ∼ N : LL → c. Because of the form of the terms and of the type (i.e. LL)
the last rule applied can only be TEncH, TEncL, TAencH, TAencL, TSignH, TSignL, TLRL’ or TSub.
The TLRL’ case is impossible, since by Lemma B.14 it would imply that sign(M, k) is either a variable or a nonce.
In the TSub case, we have Γ ⊢ sign(M, k) ∼ N : T ′ → c for some T ′ such that T ′ <: LL. By point 3, T ′ = LL, and the premise of the
rule thus gives a shorter derivation of Γ ⊢ sign(M, k) ∼ N : LL → c. The induction hypothesis applied to this shorter derivation proves the
claim.
The TEncH, TEncL, TAencH and TAencL cases are impossible, since the condition of the rule would then imply Γ ⊢ sign(M, k) ∼ N :
(T )k → c ′ (or {T }k ) for some T , k, c ′, which is not possible by Lemma B.15.
Finally, in the TSignH and TSignL cases, the premises of the rule directly proves the claim.
The symmetric properties, as described in point 3, have analogous proofs.



Lemma B.17 (Pair types). For all environment Γ, for all M, N , T , c:
(1) For all T1 , T2 , if Γ ⊢ M ∼ N : T1 ∗ T2 → c then
• either there exist M 1 , M 2 , N 1 , N 2 , c 1 , c 2 such that M = hM 1 , M 2 i, N = hN 1 , N 2 i, c = c 1 ∪ c 2 , and Γ ⊢ M 1 ∼ N 1 : T1 → c 1 and
Γ ⊢ M 2 ∼ N 2 : T2 → c 2 ;
• or M and N are variables.
(2) For all M 1 , M 2 , if T <: LL and Γ ⊢ hM 1 , M 2 i ∼ N : T → c then either T = LL or there exists T1 , T2 such that T = T1 ∗ T2 .
(3) For all M 1 , M 2 , if Γ ⊢ hM 1 , M 2 i ∼ N : LL → c then there exist N 1 , N 2 , c 1 , c 2 , such that c = c 1 ∪c 2 , N = hN 1 , N 2 i, Γ ⊢ M 1 ∼ N 1 : LL → c 1
and Γ ⊢ M 2 ∼ N 2 : LL → c 2 .
(4) The symmetric properties to the previous two points (i.e. when the term on the right is a pair) also hold.
Proof. Let us prove point 1 by induction on the typing derivation Γ ⊢ M ∼ N : T1 ∗ T2 → c. Because of the form of the type, and by
well-formedness of Γ, the only possibilities for the last rule applied are TVar, TPair, and TSub.
The claim clearly holds in the TVar and TPair cases.
In the TSub case, Γ ⊢ M ∼ N : T ′ → c for some T ′ <: T1 ∗ T2 , and by Lemma B.1, T ′ = T1′ ∗ T2′ for some T1′ , T2′ such that T1′ <: T1
and T2′ <: T2 . Therefore, by applying the induction hypothesis to Γ ⊢ M ∼ N : T1′ ∗ T2′ → c, M and N are either two variables, and the
claim holds; or two pairs, i.e. there exist M 1 , M 2 , N 1 , N 2 , c 1 , c 2 such that M = hM 1 , M 2 i, N = hN 1 , N 2 i, c = c 1 ∪ c 2 , and for i ∈ {1, 2},
Γ ⊢ Mi ∼ Ni : Ti′ → ci . Hence, by subtyping, Γ ⊢ Mi ∼ Ni : Ti → ci , and the claim holds.
We now prove point 2 by induction on the proof of Γ ⊢ hM 1 , M 2 i ∼ N : T → c. Because of the form of the terms, the last rule applied
can only be THigh, TOr, TPair, TEncH, TEncL, TAencH, TAencL, TLR’, TLRL’ or TSub.
The THigh, TLR’, and TOr cases are actually impossible by Lemma B.1, since T <: LL.
The TLRL’ and case is also impossible, since by Lemma B.14 it would imply that hM 1 , M 2 i is either a variable or a nonce.

The TEncH, TEncL, TAencH, TAencL cases are impossible, since the condition of the rule would then imply Γ ⊢ hM 1 , M 2 i ∼ N : (T )k →
c ′ (or {T }k ) for some T , k, c ′ , which is not possible by Lemma B.15.
In the TPair case, the claim clearly holds.
Finally, in the TSub case, we have Γ ⊢ hM 1 , M 2 i ∼ N : T ′ → c for some T ′ such that T ′ <: T . By transitivity of <:, T ′ <: LL, and we may
apply the induction hypothesis to Γ ⊢ hM 1 , M 2 i ∼ N : T ′ → c. Hence either T ′ = LL or T ′ = T1′ ∗ T2′ for some T1′ , T2′ . By Lemma B.1, this
implies in the ﬁrst case that T = LL and in the second case that T = LL or T is also a pair type (T , HL and T , HH in both cases, since we
already know that T <: LL).
We prove point 3 as a consequence of the ﬁrst two points, by induction on the derivation of Γ ⊢ hM 1 , M 2 i ∼ N : LL → c. The last rule
in this derivation can only be TEncH, TEncL, TAencH, TAencL, TLR’, TLRL’ or TSub by the form of the types and terms, but similarly to
the previous point TEncH, TEncL, TAencH, TAencL, TLR’ and TLRL’ are actually not possible.
Hence the last rule of the derivation is TSub. We have Γ ⊢ hM 1 , M 2 i ∼ N : T → c for some T such that T <: LL. By point 2, either
T = LL or there exist T1 , T2 such that T = T1 ∗ T2 . If T = LL, we have a shorter proof of Γ ⊢ hM 1 , M 2 i ∼ N : LL → c and we conclude by the
induction hypothesis. Otherwise, since T <: LL, by Lemma B.1, T1 <: LL and T2 <: LL. Moreover by the ﬁrst property, there exist N 1 , N 2 ,
c 1 , c 2 such that N = hN 1 , N 2 i, c = c 1 ∪ c 2 , Γ ⊢ M 1 ∼ N 1 : T1 → c 1 , and Γ ⊢ M 2 ∼ N 2 : T2 → c 2 .
Thus by subtyping, Γ ⊢ M 1 ∼ N 1 : LL → c 1 and Γ ⊢ M 2 ∼ N 2 : LL → c 2 , which proves the claim.

Lemma B.18 (Type for keys, nonces and constants). For all environment Γ, for all messages M, N , for all key k ∈ K, for all nonce or
constant n ∈ N ∪ C, for all c, l, the following properties hold:
(1)
(2)
(3)
(4)
(5)
(6)
(7)

For all T , if Γ ⊢ M ∼ N : keyl (T ) → c, then c = ∅; and either M = N are in K and Γ(M) = keyl (T ); or M and N are variables.
If l ∈ {LL, HH}, and Γ ⊢ k ∼ N : l → c, then N = k, c = ∅, and there exists T such that Γ(k) = keyl (T ).
If Γ ⊢ pk(k) ∼ N : LL → c, then k ∈ dom(Γ) and N = pk(k).
If Γ ⊢ vk(k) ∼ N : LL → c, then k ∈ dom(Γ) and N = vk(k).
If Γ ⊢ n ∼ N : HH → c, then n ∈ BN, c = ∅ and either Γ(n) = τnHH, 1 or τnHH, ∞ .
If Γ ⊢ n ∼ N : LL → c, then N = n, c = ∅, and either there exists a ∈ {1, ∞} such that Γ(n) = τnLL, a , or n ∈ F N ∪ C.
The symmetric properties to the previous ﬁve points (i.e. with k (resp. pk(k), vk(k), n) on the right) also hold.

Proof. Point 1 is easily proved by induction on the derivation of Γ ⊢ M ∼ N : keyl (T ) → c. Indeed, by the form of the type the last rule
can only be TKey, TVar, or TSub. In the TKey and TVar cases the claim clearly holds. In the TSub case, by Lemma B.1, keyl (T ) is its only
subtype, thus there exists a shorter derivation of Γ ⊢ M ∼ N : keyl (T ) → c, an the claim holds by the induction hypothesis.
We prove point 2 by induction on the derivation of Γ ⊢ k ∼ N : l → c. Because of the form of the terms and type, and by well-formedness
of Γ, the last rule applied can only be TEncH, TEncL, TAencH, TAencL, TLR’, TLRL’ or TSub.
The TEncH, TEncL, TAencH, TAencL cases are impossible since they would imply that Γ ⊢ k ∼ N : (T ′ )k ′ → c ′ (or {T ′ }k ′ ) for some
T ′ , k ′ , c ′ , which is impossible by Lemma B.15.
′
l, a
The TLR’ and TLRL’ cases are impossible. Indeed in these cases, we have Γ ⊢ k ∼ N : Jτm
; τnl , a K → ∅ for some m, n. Lemma B.14 then
implies that m = k (and n = N ), which is contradictory.
Finally, in the TSub case, we have Γ ⊢ k ∼ N : T → c for some T such that T <: l. By Lemma B.1, this implies that T is either a pair
type, a key type, or l. The ﬁrst case is impossible by Lemma B.17, since k ∈ K. The last case is trivial by the induction hypothesis. Only the
case where T = keyl (T ′ ) (for some T ′ ) remains. By point 1, in that case, since k is not a variable, we have Γ(k) = keyl (T ′) and k = N , and
therefore the claim holds.
Similarly, we prove point 3 by induction on the derivation of Γ ⊢ pk(k) ∼ N : LL → c. Because of the form of the terms and type, and by
well-formedness of Γ, the last rule applied can only be TEncH, TEncL, TAencH, TAencL, TLR’, TLRL’, TPubKey or TSub.
The TEncH, TEncL, TAencH, TAencL cases are impossible since they would imply that Γ ⊢ pk(k) ∼ N : (T ′ )k ′ → c ′ (or {T ′ }k ′ ) for
some T ′ , k ′ , c ′ , which is impossible by Lemma B.15.
′
l, a
The TLR’ and TLRL’ cases are impossible. Indeed in these cases, we have Γ ⊢ pk(k) ∼ N : Jτm
; τnl , a K → ∅ for some m, n. Lemma B.14
then implies that m = pk(k) (and n = N ), which is contradictory.
In the TSub case, we have Γ ⊢ pk(k) ∼ N : T → c for some T such that T <: l. By Lemma B.1, this implies that T is either a pair type, a
key type, or l. Just as in the previous point, the ﬁrst case is impossible and the last one is trivial. The case where T = keyl (T ′) (for some T ′ )
is also impossible by point 1, since pk(k) is not in K ∪ X.
Finally in the TPubKey case, the claim clearly holds.
Point 4 has a similar proof to point 3.
The remaining properties have similar proofs to point 2. For point 5, i.e. if Γ ⊢ n ∼ t : HH → c, only the TNonce, TSub, and TLR’ cases
are possible. The claim clearly holds in the TNonce case.

HH, a
HH, a
In the TLR’ case, we have Γ ⊢ n ∼ t : Jτm
; τpHH, a K → ∅ for some m, p. Lemma B.14 then implies that m = n, and p = t, and Γ(n) = τm
,

and Γ(p) = τpHH, a , which proves the claim.
In the TSub case, Γ ⊢ n ∼ t : T → c for some T <: HH, thus by Lemma B.1 T is either a pair type (impossible by Lemma B.17), a key type
(impossible by point 1), or HH (and we conclude by the induction hypothesis).

For point 6, similarly, only the TNonceL, TCstFN, TSub, TLRL’ cases are possible. The TSub case is proved in the same way as for the
third property. The TLRL’ case is proved similarly to the previous point. Finally the claim clearly holds in the TNonceL and TCstFN cases.
The symmetric properties, as described in point 7, have analogous proofs.



Lemma B.19 (Type LL implies same head symbol). For all Γ, M, N , c, if Γ ⊢ M ∼ N : LL → c then either M and N have the same head
symbol and use the same key if this symbol is enc, aenc or sign(,;) or M, N both are variables.
Proof. We prove a slightly more general property: for all T <: LL, if Γ ⊢ M ∼ N : T → c then either M and N have the same head
symbol and use the same key if this symbol is enc, aenc or sign(,;) or M, N both are variables.
This is proved by induction on the typing derivation. Many of the cases for the last rule applied are immediate, since they directly state
that the two terms have the same head symbol (with the same key) or are variables. This covers rules TNonceL, TCstFN, TPubKey, TVKey,
TKey, TVar, TPair, TEnc, TAenc, TSignH, TSignL, THash, THashL, TLRVar. Among the remaining cases, some are also immediate thanks
to the assumption that T <: LL, as they contradict it (which we prove using Lemma B.1). This covers rules TNonce, THigh, TOr, TLR1 ,
TLR∞ , TLR’. Moreover in the case of rule TSub the claim follows directly from the application of the induction hypothesis to the premise
of the rule.
Only the cases of rules TEncH, TEncL, TAencH, TAencL, and TLRL’ remain. In the TEncH case, Γ ⊢ M ∼ N : (T )k → c for some T ,
k, and therefore by Lemma B.15 M and N are either two variables or some terms encrypted with k, and in both cases the claim holds. The
LL, a
LL, a
TEncL, TAencH, TAencL cases are similar, using Lemma B.15. In the TLRL’ case, Γ ⊢ M ∼ N : Jτm
; τm
K → c for some m. Thus by
Lemma B.14, either M and N are two variables or M = N = m, and in any case the claim holds, which concludes this proof.

Lemma B.20 (Application of destructors). For all Γ, y, such that y < dom(Γ), for all d, T , T ′ , c, for all ground messages M, N , if
Γ, y : T ⊢ d(y) : T ′ and Γ ⊢ M ∼ N : T → c, then:
(1) We have:
(d(M)) ↓= ⊥ ⇐⇒ (d(N )) ↓= ⊥
(2) And if (d(M)) ↓, ⊥ then there exists c ′ ⊆ c such that
Γ ⊢ (d(M)) ↓∼ (d(N )) ↓: T ′ → c ′
Proof. We distinguish four cases for d.
• d = dec(·, k). We know that Γ, y : T ⊢ d(y) : T ′ , which can be proved using either rule DDecH, rule DDecL, or rule DDecT. In the
ﬁrst two cases, T = LL, and in the last case T = (T ′ )k .
– Let us prove 1) by contraposition. Assume d(M) ↓, ⊥. Hence, M = enc(M ′, k) for some M ′ . Lemma B.19 in the DDecH and DDecL
cases (where Γ ⊢ M ∼ N : LL → c), and Lemma B.15 in the DDecT case (where Γ ⊢ M ∼ N : (T ′ )k → c), guarantee that there
exists N ′ such that N = enc(N ′, k). Therefore d(N ) ↓, ⊥ which proves the ﬁrst direction of 1). The other direction is analogous.
– Moreover, still assuming d(M) ↓, ⊥, and keeping the notations from the previous point, we have d(M) ↓= M ′ and d(N ) ↓= N ′ .
The destructor typing rule applied to prove Γ, y : LL ⊢ d(y) : T ′ can be DDecT, DDecH, or DDecL.
∗ In the DDecT case we have T = (T ′)k and therefore Γ ⊢ M ∼ N : (T ′ )k → c. Lemma B.15 (point 1) then guarantees that
Γ ⊢ M ′ ∼ N ′ : T ′ → c, which proves point 2).
∗ In the DDecH case we have T = LL and Γ(k) = keyHH (T ′ ). Thus, we have Γ ⊢ enc(M ′, k) ∼ enc(N ′, k) : LL → c, and by
Lemma B.15 (point 5), we know that there exists c ′ such that c = c ′ ∪ {M ∼ N } and Γ ⊢ M ′ ∼ N ′ : T ′ → c ′ , which proves point
2).
∗ In the DDecL case we have T = T ′ = LL and there exists T ′′ such that Γ(k) = keyLL (T ′′ ). Thus, we have Γ ⊢ enc(M ′, k) ∼
enc(N ′, k) : LL → c, and by Lemma B.15 (point 5), we know that Γ ⊢ M ′ ∼ N ′ : LL → c, which proves point 2).
In all cases, point 2) holds, which concludes this case.
• d = adec(·, k). We know that Γ, y : T ⊢ d(y) : T ′ , which can be proved using either rule DAdecH, rule DAdecL, or rule DAdecT. In
the ﬁrst two cases, T = LL, and in the last case T = {T ′ }k .
– Let us prove 1) by contraposition. Assume d(M) ↓, ⊥. Hence, M = aenc(M ′, pk(k)) for some M ′ . Lemma B.19 in the DAdecH and
DAdecL cases (where Γ ⊢ M ∼ N : LL → c), and Lemma B.15 in the DAdecT case (where Γ ⊢ M ∼ N : {T ′ }k → c), guarantee that
there exists N ′ such that N = aenc(N ′, pk(k)). Therefore d(N ) ↓, ⊥ which proves the ﬁrst direction of 1). The other direction is
analogous.
– Moreover, still assuming d(M) ↓, ⊥, and keeping the notations from the previous point, we have d(M) ↓= M ′ and d(N ) ↓= N ′ .
The destructor typing rule applied to prove Γ, y : LL ⊢ d(y) : T ′ can be DAdecT, DAdecH, or DAdecL.

∗ In the DAdecT case we have T = {T ′ }k and thus Γ ⊢ M ∼ N : {T ′ }k → c. Lemma B.15 then guarantees that Γ ⊢ M ′ ∼ N ′ :
T ′ → c which proves the claim.
∗ In the DAdecH case we have T = LL, and there exists T ′′ such that T ′ = T ′′ ∨ LL and Γ(k) = keyHH (T ′′ ). Thus, we have
Γ ⊢ aenc(M ′, pk(k)) ∼ aenc(N ′, pk(k)) : LL → c. Hence by Lemma B.15 (point 5), we know that either there exists c ′ such that
c = c ′ ∪{M ∼ N } and Γ ⊢ M ′ ∼ N ′ : T ′′ → c ′; or Γ ⊢ M ′ ∼ N ′ : LL → c. By rule TOr, we then have Γ ⊢ M ′ ∼ N ′ : T ′′ ∨ LL → c ′
(resp. c), which proves point 2).
∗ In the DAdecL case we have T = T ′ = LL and there exists T ′′ such that Γ(k) = keyLL (T ′′ ). Thus, we have Γ ⊢ aenc(M ′, pk(k)) ∼
aenc(N ′, pk(k)) : LL → c, and by Lemma B.15 (point 5), we know that Γ ⊢ M ′ ∼ N ′ : LL → c, which proves point 2).
In all cases, point 2) holds, which concludes this case.
• d = checksign(·, vk(k)). We know that Γ, y : T ⊢ d(y) : T ′ , which can be proved using either rule DCheckH or rule DCheckL. In
both cases, T = LL.
– Let us prove 1) by contraposition. Assume d(M) ↓, ⊥. Hence, M = sign(M ′, k) for some M ′ . Lemma B.19 (applied to Γ ⊢ M ∼ N :
LL → c) guarantees that there exists N ′ such that N = sign(N ′, k). Therefore d(N ) ↓, ⊥ which proves the ﬁrst direction of 1).
The other direction is analogous.
– Moreover, still assuming d(M) ↓, ⊥, and keeping the notations from the previous point, we have d(M) ↓= M ′ and d(N ) ↓= N ′ .
The destructor typing rule applied to prove Γ, y : LL ⊢ d(y) : T ′ can be DCheckH or DCheckL.
∗ In the DCheckH case we have T = LL, and Γ(k) = keyHH (T ′ ). Thus we have Γ ⊢ sign(M ′, k) ∼ sign(N ′, k) : LL → c. Hence
by Lemma B.16 (point 2), we know that there exist c ′ , c ′′ such that c = c ′ ∪ c ′′ ∪ {M ∼ N }, Γ ⊢ M ′ ∼ N ′ : T ′ → c ′ , and
Γ ⊢ M ′ ∼ N ′ : LL → c ′′ . This proves point 2).
∗ In the DCheckL case we have T = LL, and there exists T ′′ such that Γ(k) = keyLL (T ′′ ). Hence by Lemma B.16 (point 2), we
know that Γ ⊢ M ′ ∼ N ′ : LL → c. This proves point 2).
In all cases, point 2) holds, which concludes this case.
• d = π1 . We know that Γ, y : T ⊢ d(y) : T ′ , which can be proved using either rule DFst or DFstL. In the ﬁrst case, T = T1 ∗ T2 is a pair
type, and in the second case T = LL.
– We prove 1) by contraposition. Assume d(M) ↓, ⊥. Hence, M = hM 1 , M 2 i for some M 1 , M 2 . Thus, by applying Lemma B.17 to
Γ ⊢ M ∼ N : T → c, in any case we know that there exist N 1 , N 2 such that N = hN 1 , N 2 i. Therefore d(N ) ↓, ⊥ which proves the
ﬁrst direction of 1). The other direction is analogous.
– Moreover, still assuming d(M) ↓, ⊥, and keeping the notations from the previous point, we have d(M) ↓= M 1 and d(N ) ↓= N 1 . In
addition, we know that Γ, y : T ⊢ d(y) : T ′, which can be proved using either rule DFst or DFstL. Lemma B.17, which we applied
in the previous point, also implies that there exist c 1 , c 2 , such that c = c 1 ∪ c 2 and for i ∈ {1, 2}, Γ ⊢ Mi ∼ Ni : Ti → ci (in the
DFst case) or Γ ⊢ Mi ∼ Ni : LL → ci (in the DFstL case).
We distinguish two cases for the rule applied to prove Γ, y : T ⊢ d(y) : T ′ .
∗ DFst: Then T = T1 ∗ T2 and T ′ = T1 , and Γ ⊢ M 1 ∼ N 1 : T1 → c 1 (⊆ c) proves 2).
∗ DFstL: Then T = T ′ = LL, and Γ ⊢ M 1 ∼ N 1 : LL → c 1 (⊆ c) proves 2).
In both cases, point 2) holds, which concludes this case.
• d = π2 . This case is similar to the previous one.

Lemma B.21 (LL type is preserved by attacker terms). For all Γ, for all frames ψ = new EΓ .ϕ and ψ ′ = new EΓ .ϕ ′ with Γ ⊢ ϕ ∼ ϕ ′ :
LL → c, for all attacker term R such that vars(R) ⊆ dom(ϕ),
either there exists c ′ ⊆ c such that
Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′
or
Rϕ ↓= Rϕ ′ ↓= ⊥.
Proof. Let us recall that EΓ denotes the set of names in Γ.
We show this property by induction over the attacker term R.
Induction Hypothesis: the statement holds for all subterms of R. There are several cases for R. The base cases are the cases where R is a
variable, a name in F N or a constant in C.
(1) R = x Since vars(R) ⊆ dom(ϕ), we have x ∈ dom(ϕ) = dom(ϕ ′ ), hence Rϕ ↓= ϕ(x) and Rϕ ′ ↓= ϕ ′ (x). Since Γ ⊢ ϕ ∼ ϕ ′ : LL → c, we
have Γ ⊢ ϕ(x) ∼ ϕ ′ (x) : LL → c x for some c x ⊆ c, and the claim holds.
(2) R = a with a ∈ C ∪ F N . Then Rϕ ↓= Rϕ ′ ↓= a and by rule TCstFN, we have Γ ⊢ a ∼ a : LL → ∅. Hence the claim holds.
(3) R = pk(K) We apply the induction hypothesis to K and distinguish three cases.
(a) If Kϕ ↓= ⊥ then Kϕ ′ ↓= ⊥, hence Rϕ ↓= Rϕ ′ ↓= ⊥.
(b) If Kϕ ↓, ⊥ and is not a key then Kϕ ′ ↓, ⊥ (by IH), and by IH we have Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′ for some c ′ ⊆ c. Then by
Lemma B.19, Kϕ ′ ↓ is not a key either. Hence Rϕ ↓= Rϕ ′ ↓= ⊥.

(c) If Kϕ ↓ is a key, then by IH there exists c ′ ⊆ c such that Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′. Hence by Lemma B.18 Kϕ ↓= Kϕ ′ ↓, and
(4) R
(a)
(b)
(c)

Γ(Kϕ ↓) = Γ(Kϕ ′ ↓) = keyLL (T ) for some T . Therefore by rule TPubKey, Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → ∅ and the claim holds.
= vk(K) We apply the induction hypothesis to K and distinguish three cases.
If Kϕ ↓= ⊥ then Kϕ ′ ↓= ⊥, hence Rϕ ↓= Rϕ ′ ↓= ⊥.
If Kϕ ↓, ⊥ and is not a key then Kϕ ′ ↓, ⊥ (by IH), and by IH we have Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′ for some c ′ ⊆ c. Then, by
Lemma B.19, Kϕ ′ ↓ is not a key either. Hence Rϕ ↓= Rϕ ′ ↓= ⊥.
If Kϕ ↓ is a key, then by IH there exists c ′ ⊆ c such that Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′. Hence by Lemma B.18 Kϕ ↓= Kϕ ′ ↓, and

Γ(Kϕ ↓) = Γ(Kϕ ′ ↓) = keyLL (T ) for some T . Therefore by rule TVKey, Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → ∅ and the claim holds.
(5) R = hR 1 , R 2 i where R 1 and R 2 are also attacker terms. We then apply the induction hypothesis to the same frames and R 1 , R 2 . We
distinguish two cases:
(a) R 1ϕ ↓= ⊥ ∨ R 2ϕ ↓= ⊥ In this case we also have R 1ϕ ′ ↓= ⊥ ∨ R 2ϕ ′ ↓= ⊥ and therefore Rϕ ↓= Rϕ ′ ↓= ⊥.
(b) R 1ϕ ↓, ⊥ ∧ R 2ϕ ↓, ⊥ In this case, by the induction hypothesis, we also have R 1ϕ ′ ↓, ⊥ ∧ R 2ϕ ′ ↓, ⊥, and we also know that there
exist c 1 ⊆ c and c 2 ⊆ c such that Γ ⊢ R 1ϕ ↓∼ R 1ϕ ′ ↓: LL → c 1 and Γ ⊢ R 2ϕ ↓∼ R 2ϕ ′ ↓: LL → c 2 .
Thus, by the rule TPair followed by TSub, Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c 1 ∪ c 2 . Since c 1 ∪ c 2 ⊆ c, this proves the case.
(6) R = enc(S, K) We apply the induction hypothesis to K and distinguish three cases.
(a) If Kϕ ↓= ⊥ then Kϕ ′ ↓= ⊥, hence Rϕ ↓= Rϕ ′ ↓= ⊥.
(b) If Kϕ ↓, ⊥ and is not a key then Kϕ ′ ↓, ⊥ (by IH), and by IH we have Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′ for some c ′ ⊆ c. Then, by
Lemma B.19, Kϕ ′ ↓ is not a key either. Hence Rϕ ↓= Rϕ ′ ↓= ⊥.
(c) If Kϕ ↓ is a key, then by IH there exists c ′ ⊆ c such that Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′. Hence by Lemma B.18 Kϕ ↓= Kϕ ′ ↓, and

(7) R
(a)
(b)
(c)

(8) R
(a)
(b)
(c)

(9) R
(a)
(b)
(10) R
(a)
(b)
(c)
(11) R
(12) R
(a)

Γ(Kϕ ↓) = Γ(Kϕ ′ ↓) = keyLL (T ) for some T . We then apply the IH to S, and either Sϕ ↓= Sϕ ′ ↓= ⊥, in which case Rϕ ↓= Rϕ ′ ↓= ⊥;
or there exists c ′′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′′ . Since Rϕ ↓= enc(Sϕ ↓, Kϕ ↓), and similarly for ϕ ′ , by rule TEnc, we
have Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: (LL)Kϕ ↓ → c ′′ , and then by rule TEncL, Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′′ .
= aenc(S, K) We apply the induction hypothesis to K and distinguish three cases.
If Kϕ ↓= ⊥ then Kϕ ′ ↓= ⊥, hence Rϕ ↓= Rϕ ′ ↓= ⊥.
If Kϕ ↓, ⊥ and is not pk(k) for some k ∈ K then Kϕ ′ ↓, ⊥ (by IH), and by IH there exists c ′ ⊆ c such that Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓:
LL → c ′ . Then, by Lemma B.19, Kϕ ′ ↓ is not a public key either. Hence Rϕ ↓= Rϕ ′ ↓= ⊥.
If Kϕ ↓= pk(k) for some k ∈ K, then by IH there exists c ′ ⊆ c such that Γ ⊢ pk(k) ∼ Kϕ ′ ↓: LL → c ′ . Thus, by Lemma B.18,
Kϕ ′ ↓= pk(k) and k ∈ dom(Γ). We then apply the IH to S, and either Sϕ ↓= Sϕ ′ ↓= ⊥, in which case Rϕ ↓= Rϕ ′ ↓= ⊥; or there
exists c ′′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′′ . Therefore, by rule TAenc, Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: {LL}k → c ′′ , and by rule TAencL
we have Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′′ .
= sign(S, K) We apply the induction hypothesis to K and distinguish three cases.
If Kϕ ↓= ⊥ then Kϕ ′ ↓= ⊥, hence Rϕ ↓= Rϕ ′ ↓= ⊥.
If Kϕ ↓, ⊥ and is not a key k ∈ K then Kϕ ′ ↓, ⊥ (by IH), and by IH we have Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′ for some c ′ ⊆ c. Then,
by Lemma B.19, Kϕ ′ ↓ is not a key either. Hence Rϕ ↓= Rϕ ′ ↓= ⊥.
If Kϕ ↓= k for some k ∈ K, then by IH there exists c ′ ⊆ c such that Γ ⊢ Kϕ ↓∼ Kϕ ′ ↓: LL → c ′ . Hence by Lemma B.18, Kϕ ′ ↓= k
and Γ(k) = keyLL (T ) for some T . We then apply the IH to S, and either Sϕ ↓= Sϕ ′ ↓= ⊥, in which case Rϕ ↓= Rϕ ′ ↓= ⊥; or there
exists c ′′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′′ . Therefore by rule TSignL, Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′′ .
= h(S) We apply the induction hypothesis to S. We distinguish two cases:
Sϕ ↓= ⊥ In this case we also have Sϕ ′ ↓= ⊥ and therefore Rϕ ↓= Rϕ ′ ↓= ⊥.
Sϕ ↓, ⊥ In this case, by the induction hypothesis, we also have Sϕ ′ ↓, ⊥, and we also know that there exists c ′ ⊆ c such that
Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′ Thus, by rule THashL, Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′ , which proves this case.
= π1 (S) We apply the induction hypothesis to S and distinguish three cases.
Sϕ ↓= ⊥ Then Sϕ ′ ↓= ⊥ (by IH), hence Rϕ ↓= Rϕ ′ ↓= ⊥.
Sϕ ↓, ⊥ and is not a pair Then by IH there exists c ′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′, which implies that Rϕ ′ ↓ and is not
a pair either by Lemma B.19. Hence Rϕ ↓= Rϕ ′ ↓= ⊥.
Sϕ ↓= ht 1 , t 2 i is a pair Then by IH there exists c ′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′. This implies, by Lemma B.17, that
Sϕ ′ ↓= ht 1′ , t 2′ i is also a pair, and that Γ ⊢ t 1 ∼ t 1′ : LL → c ′′ for some c ′′ ⊆ c ′. Since Rϕ ↓= t 1 and Rϕ ′ ↓= t 1′ , this proves the case.
= π2 (S) This case is analogous to the case 10.
= dec(S, K) We apply the induction hypothesis to K and, similarly to the case 6, we distinguish several cases.
If Kϕ ↓= ⊥ or is not a key then, as in case 6, Rϕ ↓= Rϕ ′ ↓= ⊥.

(b) If Kϕ ↓ is a key, then similarly to case 6 we can show that Kϕ ↓= Kϕ ′ ↓, and Γ(Kϕ ↓) = Γ(Kϕ ′ ↓) = keyLL (T ) for some T . We then
apply the IH to S, which creates two cases. Either Sϕ ↓= Sϕ ′ ↓= ⊥, or there exists c ′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′. In
the ﬁrst case, the claim holds, since Rϕ ↓= Rϕ ′ ↓= ⊥. In the second case, by Lemma B.19, we know that Sϕ ↓ is an encryption by

Kϕ ↓ if and only if Sϕ ′ ↓ also is an encryption by this key. Consequently, if Sϕ ↓ is not an encryption by Kϕ ↓ (= Kϕ ′ ↓), then it is
the same for Sϕ ′ ↓; and Rϕ ↓= Rϕ ′ ↓= ⊥. Otherwise, Sϕ ↓= enc(t, Kϕ ↓) and Sϕ ′ ↓= enc(t ′, Kϕ ′ ↓) for some t, t ′ . In that case, by
IH, we have Γ ⊢ enc(t, Kϕ ↓) ∼ enc(t ′, Kϕ ′ ↓) : LL → c ′ . Therefore, by Lemma B.15 (point 5), Γ ⊢ t ∼ t ′ : LL → c ′ , which is to say
Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′ . Hence the claim holds in this case.
(13) R = adec(S, K) We apply the induction hypothesis to K and, similarly to the case 6, we distinguish several cases.
(a) If Kϕ ↓= ⊥ or is not a key then, as in case 6, Rϕ ↓= Rϕ ′ ↓= ⊥.
(b) If Kϕ ↓ is a key, then similarly to case 6 we can show that Kϕ ↓= Kϕ ′ ↓, and Γ(Kϕ ↓) = Γ(Kϕ ′ ↓) = keyLL (T ) for some T . We then
apply the IH to S, which creates two cases. Either Sϕ ↓= Sϕ ′ ↓= ⊥, or there exists c ′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′. In
the ﬁrst case, the claim holds, since Rϕ ↓= Rϕ ′ ↓= ⊥. In the second case, by Lemma B.19, we know that Sϕ ↓ is an asymmetric
encryption by pk(Kϕ ↓) if and only if Sϕ ′ ↓ also is an encryption by this key. Consequently, if Sϕ ↓ is not an encryption by pk(Kϕ ↓)
(= pk(Kϕ ′ ↓)), then it is the same for Sϕ ′ ↓, and Rϕ ↓= Rϕ ′ ↓= ⊥. Otherwise, Sϕ ↓= aenc(t, pk(Kϕ ↓)) and Sϕ ′ ↓= aenc(t ′, pk(Kϕ ′ ↓
)) for some t, t ′ . Thus by IH we have Γ ⊢ aenc(t, pk(Kϕ ↓)) ∼ aenc(t ′, pk(Kϕ ′ ↓)) : LL → c ′ . Therefore, by Lemma B.15 (point 6),
we know that Γ ⊢ t ∼ t ′ : LL → c ′, which is to say Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′ . Hence the claim holds in this case.
(14) R = checksign(S, K) We apply the induction hypothesis to K and, similarly to the case 7, we distinguish several cases.
(a) If Kϕ ↓= ⊥ or is not a veriﬁcation key then, as in case 7, we can show that Rϕ ↓= Rϕ ′ ↓= ⊥.
(b) If Kϕ ↓ is a veriﬁcation key vk(k) for some k ∈ K, then similarly to case 7 we can show that Kϕ ↓= Kϕ ′ ↓, and k ∈ dom(Γ). We
then apply the IH to S, which creates two cases. Either Sϕ ↓= Sϕ ′ ↓= ⊥, or there exists c ′ ⊆ c such that Γ ⊢ Sϕ ↓∼ Sϕ ′ ↓: LL → c ′ .
In the ﬁrst case, the claim holds, since Rϕ ↓= Rϕ ′ ↓= ⊥. In the second case, by Lemma B.19, we know that Sϕ ↓ is a signature
by k(= Kϕ ↓) if and only if Sϕ ′ ↓ also is a signature by this key. Consequently, if Sϕ ↓ is not signed by k, then neither is Sϕ ′ ↓,
and Rϕ ↓= Rϕ ′ ↓= ⊥. Otherwise, Sϕ ↓= sign(t, k) and Sϕ ′ ↓= sign(t ′, k) for some t, t ′ . Thus by IH we have Γ ⊢ sign(t, k) ∼
sign(t ′, k) : LL → c ′ . Therefore, by Lemma B.16 (point 2), we know that there exists c ′′ ⊆ c ′ such that Γ ⊢ t ∼ t ′ : LL → c ′′ . That
is to say Γ ⊢ Rϕ ↓∼ Rϕ ′ ↓: LL → c ′′ . Hence the claim holds in this case.

Lemma B.22 (Substitution preserves typing). For all Γ, Γ ′ , Γ ′′ , such that Γ ∪Γ ′ ∪Γ ′′ ⊢ ⋄, (we do not require that Γ and Γ ′ are well-formed),
for all M, N , T , c σ , c, for all ground substitutions σ , σ ′ , if
• Γ, Γ ′ only contains variables, and have disjoint domains;
• Γ ′′ only contains names and keys;
′
l, 1
• for all x ∈ dom(Γ ′ ), Γ ′ (x) is not of the form Jτm
; τnl , 1 K,
• (Γ ∪ Γ ′′ ) N, K ⊢ σ ∼ σ ′ : (Γ ∪ Γ ′′ ) X → c σ ,
• and Γ ∪ Γ ′ ∪ Γ ′′ ⊢ M ∼ N : T → c
then there exists c ′ ⊆ JcKσ , σ ′ ∪ c σ such that
Γ ′ ∪ Γ ′′ ⊢ Mσ ∼ N σ ′ : T → c ′ .
′′′
′
′′
In particular, if we have Γ = Γ X , Γ = ∅, and Γ = Γ ′′′ N, K for some Γ ′′′ , then the ﬁrst three conditions trivially hold.
Proof. Note that ΓN, K = Γ ′ N, K = ∅, ΓX = Γ, Γ ′ X = Γ ′ , Γ ′′ N, K = Γ ′′ and Γ ′′ X = ∅. This proof is done by induction on the typing
derivation for the terms. The claim clearly holds in the TNonce, TNonceL, TCstFN, TPubKey, TVKey, TKey, THash, THigh, TLR1 , TLR∞
since their conditions do not use Γ(x) (for any variable x) or another type judgement, and they still apply to the messages Mσ and N σ ′ .
It follows directly from the induction hypothesis in all other cases except the TVar and TLRVar cases, which are the base cases.
In the TVar case, the claim also holds, since M = N = x for some variable x ∈ dom(Γ) ∪ dom(Γ ′ ). If x ∈ dom(Γ ′ ), then xσ = xσ ′ = x, and
T = Γ ′ (x). Thus, by rule TVar, Γ ′ ∪ Γ ′′ ⊢ xσ ∼ xσ ′ : Γ ′ (x) → ∅ and the claim holds. If x ∈ dom(Γ), then T = Γ(x), and, since by hypothesis
the substitutions are well-typed, there exists c x ⊆ c σ , σ ′ such that (Γ ∪ Γ ′′ ) N, K ⊢ σ (x) ∼ σ ′ (x) : Γ(x) → c x . Thus, since (Γ ∪ Γ ′′ ) N, K = Γ ′′ ,
and by applying Lemma B.10 to Γ ′ , Γ ′ ∪ Γ ′′ ⊢ σ (x) ∼ σ ′ (x) : Γ(x) → c x and the claim holds.
′

′′

′′′

l, 1 l , 1 l , 1 l , 1
Finally, in the TLRVar case, there exist two variables x, y, and types τm
, τn , τm′ , τn′ , such that M = x, N = y, c = ∅, Γ ∪ Γ ′ ∪ Γ ′′ ⊢
′

′′

′′′

′′′

l, 1
l, 1
l ,1
l ,1
K → ∅, and T = Jτm
; τnl ′ , 1 K.
x ∼ x : Jτm
; τnl , 1 K → ∅, Γ ∪ Γ ′ ∪ Γ ′′ ⊢ y ∼ y : Jτm
′ ; τn ′
l ′, 1

l, 1
By Lemma B.14, this implies that (Γ ∪ Γ ′ ∪ Γ ′′ )(x) = Jτm
; τn K and (Γ ∪ Γ ′ ∪ Γ ′′ )(y) = J l ′′ ; 1Km ′l ′′′ 1n ′. Hence, since by hypothesis
′′
does not contain such types, and Γ does not contain variables, x ∈ dom(Γ) and y ∈ dom(Γ).
′
l, 1
Moreover, by the induction hypothesis, there exist c ′ , c ′′ ⊆ c σ such that Γ ′ ∪ Γ ′′ ⊢ xσ ∼ xσ ′ : Jτm
; τnl , 1 K → c ′, and Γ ′ ∪ Γ ′′ ⊢ yσ ∼
′′
′′′
′
l ,1
l ,1
l, 1
yσ ′ : Jτm
K → c ′′ . That is to say, since x, y ∈ dom(Γ) = dom(σ ) = dom(σ ′ ), that Γ ′ ∪ Γ ′′ ⊢ σ (x) ∼ σ ′ (x) : Jτm
; τnl , 1 K → c ′ , and
′ ; τn ′

Γ′

′′

′′′

l ,1
l ,1
K → c ′′ . Hence, by Lemma B.14, and since σ , σ ′ are ground, we have σ (x) = m, σ ′ (x) = n, σ (y) = m ′,
Γ ′ ∪ Γ ′′ ⊢ σ (y) ∼ σ ′ (y) : Jτm
′ ; τn ′
′′′

l, 1
and σ ′ (y) = n ′, and Γ ′′ (m) = τm
and Γ ′′ (n ′) = τnl ′ , 1 .
′′′

l, 1
Thus, by rule TLR1 , Γ ′ ⊢ σ (x) ∼ σ ′ (y) : Jτm
; τnl ′ , 1 K → ∅, which proves the claim.



Lemma B.23 (Types LL and HH are disjoint). For all Γ, for all ground terms M, M ′ , N , N ′, for all sets of constraints c, c ′, if Γ ⊢ M ∼ N :
LL → c and Γ ⊢ M ′ ∼ N ′ : HH → c ′ then M , M ′ and N , N ′.
Proof. First, it is easy to see by induction on the type derivation that for all ground terms M, N , for all c, if Γ ⊢ M ∼ N : HH → c then
either
•
•
•
•

HH, a
M is a nonce m ∈ N such that Γ(m) = τm
for some a ∈ {∞, 1};
HH
or M is a key and Γ(M) = key (T ) for some T ;
or Γ ⊢ M ∼ N : HH ∗ T → c ′ for some T , c ′ ;
or Γ ⊢ M ∼ N : T ∗ HH → c ′ for some T , c ′ .

Indeed, (as Γ is well-formed) the only possible cases are TNonce, TSub, and TLR’. In the TNonce case the claim clearly holds. In the
TSub case we use Lemma B.1 followed by Lemma B.18. In the TLR’ case we apply Lemma B.14 and the claim directly follows.
Let us now show that for all M, N , N ′ ground, for all c, c ′ , Γ ⊢ M ∼ N : LL → c and Γ ⊢ M ∼ N ′ : HH → c ′ cannot both hold.
(This corresponds, with the notations of the statement of the lemma, to proving by contradiction that M , M ′ . The proof that N , N ′ is
analogous.)
We show this property by induction on the size of t 1 .
Since Γ ⊢ M ∼ N ′ : HH → c ′, by the property stated in the beginning of this proof, we can distinguish four cases.
HH, a
• If M is a nonce and Γ(M) = τ M
: then this contradicts Lemma B.18. Indeed, this lemma (point 5) implies that M ∈ BN , but also (by
LL, a
point 6), since Γ ⊢ M ∼ N : LL → c, that either Γ(M) = τ M
for some a ∈ {1, ∞}, or M ∈ F N ∪ C.
HH
• If M is a key and Γ(M) = key (T ) for some T : then by Lemma B.18, since Γ ⊢ M ∼ N : LL → c, there exists T ′ such that Γ(M) =

keyLL (T ′ ). This contradicts Γ(M) = keyHH (T ).
• If Γ ⊢ M ∼ N ′ : HH ∗ T → c ′′ for some T , c ′′ : then by Lemma B.17, since M, N ′ are ground, there exist M 1 , M 2 , N 1′ , N 2′ , c 1′ such that
M = hM 1 , M 2 i, N ′ = hN 1′, N 2′i, and Γ ⊢ M 1 ∼ N 1′ : HH → c 1′ . Moreover, since Γ ⊢ M ∼ N : LL → c, also by Lemma B.17, there exist
N 1 , N 2 , c 1 such that N = hN 1 , N 2 i and Γ ⊢ M 1 ∼ N 1 : LL → c 1 . However, by the induction hypothesis, Γ ⊢ M 1 ∼ N 1′ : HH → c 1′ and
Γ ⊢ M 1 ∼ N 1 : LL → c 1 is impossible.
• If Γ ⊢ M ∼ N ′ : T ∗ HH → c ′′ for some T , c ′′ : this case is similar to the previous one.

Lemma B.24 (Low terms are recipes on their constraints). For all ground messages M, N , for all T <: LL, for all Γ, c, if Γ ⊢ M ∼ N :
Γ ) and N = R(ϕ (c) ∪ ϕ Γ ).
T → c then there exists an attacker recipe R without destructors such that M = R(ϕ l(c) ∪ ϕ LL
r
LL
Proof. We prove this lemma by induction on the typing derivation of Γ ⊢ M ∼ N : T → c. We distinguish several cases for the last rule
in this derivation.
• TNonce, TEnc, TAenc, THigh, TOr, TLR1 , TLR∞ , TLR’, TLRVar: these cases are not possible, since the type they give to terms is
never a subtype of LL by Lemma B.1.
• TVar: this case is not possible since M, N are ground.
• TSub: this case is directly proved by applying the induction hypothesis to the judgement ∅ ⊢ M ∼ N : T ′ → c where T ′ <: T <: LL,
which appears in the conditions of this rule, and has a shorter derivation.
• TLRL’: in this case, Γ ⊢ M ∼ N : JτnLL, a ; τnLL, a K → c ′ for some nonce n, some a ∈ {∞, 1}, some c ′, and c = ∅. By Lemma B.14, this
Γ (x) = n and the claim holds with R = x.
implies that M = N = n, and Γ(n) = τnLL, a . Thus, by deﬁnition, there exists x such that ϕ LL
LL, a
• TNonceL: in this case M = N = n for some n ∈ N such that Γ(n) = τn
for some a ∈ {1, ∞}. Hence, by deﬁnition, there exists x
Γ (x) = n and the claim holds with R = x.
such that ϕ LL
• TCstFN: then M = N = a ∈ C ∪ F N , and the claim holds with R = a.
Γ (x) = k and
• TKey: then M = N = k ∈ K and there exists T ′ such that Γ(k) = keyLL (T ′ ). By deﬁnition, there exists x such that ϕ LL
the claim holds with R = x.
Γ (x) = pk(k)
• TPubKey, TVKey: then M = N = pk(k) (resp. vk(k)) for some k ∈ dom(Γ). By deﬁnition, there exists x such that ϕ LL
(resp. vk(k)) and the claim holds with R = x.
• TPair, THashL: these cases are similar. We detail the TPair case. In that case, T = T1 ∗ T2 for some T1 , T2 . By Lemma B.1, T1 , T2
are subtypes of LL. In addition, there exist M 1 , M 2 , N 1 , N 2 , c 1 , c 2 such that Γ ⊢ Mi ∼ Ni : Ti → ci (for i ∈ {1, 2}). By applying the
Γ )
induction hypothesis to these two judgements (which have shorter proofs), we obtain R 1 , R 2 such that for all i, Mi = Ri (ϕ l(ci ) ∪ϕ LL
Γ
and Ni = Ri (ϕ r (ci ) ∪ ϕ LL ). Therefore the claim holds with R = hR 1 , R 2 i.
• TEncH, TAencH, THash, TSignH: these four cases are similar. In each case, by the form of the typing rule, we have c = {M ∼ N }∪c ′
for some c ′ . Therefore by deﬁnition of ϕ l(c), ϕ r (c), there exists x such that ϕ l(c)(x) = M and ϕ r (c)(N ) = N . The claim holds with
R = x.

• TEncL, TAencL: these two cases are similar, we write the proof for the TEncL case. The form of this rule application is:
Π
Γ ⊢ M ∼ N : (LL)k → c

Γ(k) = keyLL (T ′ )

Γ ⊢ M ∼ N : LL → c
By Lemma B.15, there exist M ′ , N ′

such that M = enc(M ′, k), N = enc(N ′, k), and Γ ⊢ M ′ ∼ N ′ : LL → c with a proof shorter that Π.
Γ ) and N ′ = R(ϕ (c) ∪ ϕ Γ ).
Thus by applying the induction hypothesis to this judgement, there exists R such that M ′ = R(ϕ l(c) ∪ ϕ LL
r
LL
LL
′
Γ
Moreover, since Γ(k) = key (T ), by deﬁnition, there exists x such that ϕ LL (x) = k (in the asymmetric case, the messages are
encrypted with a public key pk(k), which also appears in this frame). Therefore, the claim holds with the recipe enc(R, x).
• TSignL: the form of this rule application is:
Π
′

Γ ⊢ M ∼ N ′ : LL → c

Γ(k) = keyLL (T ′ )

Γ ⊢ sign(M ′, k) ∼ sign(N ′, k) : LL → c
sign(M ′, k),

sign(N ′, k).

with M =
N =
Thus by applying the induction hypothesis to Γ ⊢ M ′ ∼ N ′ : LL → c, there exists R such
∆
′
∆ ).
′
that M = R(ϕ l(c) ∪ ϕ LL ) and N = R(ϕ r (c) ∪ ϕ LL
LL
′
Γ (x) = k. Therefore, the claim holds with the recipe
Moreover, since Γ(k) = key (T ), by deﬁnition, there exists x such that ϕ LL
sign(R, x).

Lemma B.25 (Low frames with consistent constraints are statically eqivalent). For all ground ϕ, ϕ ′ , for all c, Γ, if
• Γ ⊢ ϕ ∼ ϕ ′ : LL → c
• and c is consistent in ΓN, K ,
then new EΓ .ϕ and new EΓ .ϕ ′ are statically equivalent.
Proof. We can ﬁrst notice that since ϕ and ϕ ′ are ground, so is c (this is easy to see by examining the typing rules for terms). Let R, R ′
be two attacker recipes, such that vars(R) ∪ vars(R ′ ) ⊆ dom(ϕ)(= dom(ϕ ′ )).
For all x ∈ dom(ϕ)(= dom(ϕ ′ )), by assumption, there exists c x ⊆ c such that Γ ⊢ ϕ(x) ∼ ϕ ′ (x) : LL → c x . By Lemma B.24, there exists a
Γ ) and ϕ ′ (x) = R (ϕ (c ) ∪ ϕ Γ ).
recipe R x such that ϕ(x) = R x (ϕ l(c x ) ∪ ϕ LL
x r x
LL
Γ ) and ϕ ′ (x) = R (ϕ (c) ∪ ϕ Γ ).
Since c x ⊆ c, we also have ϕ(x) = R x (ϕ l(c) ∪ ϕ LL
x r
LL
′
Let R and R be the recipes obtained by replacing every occurence of x with R x in respectively R and R ′ , for all variable x ∈ dom(ϕ)(=
dom(ϕ ′ )).
Γ ) and R ′ϕ = R ′ (ϕ (c) ∪ ϕ Γ ); and similarly Rϕ ′ = R(ϕ (c) ∪ ϕ Γ ) and R ′ϕ ′ = R ′ (ϕ (c) ∪ ϕ Γ ).
We then have Rϕ = R(ϕ l(c) ∪ ϕ LL
r
r
l
LL
LL
LL
Γ and new E .ϕ (c)∪ϕ Γ are statically
Since c is ground, and consistent in ΓN, K , by deﬁnition of consistency, the frames new EΓ .ϕ l(c)∪ϕ LL
Γ r
LL
equivalent. Hence, by deﬁnition of static equivalence,
′

Γ
Γ
R(ϕ l(c) ∪ ϕ LL
) = R (ϕ l(c) ∪ ϕ LL
)

⇐⇒

′

Γ
Γ
R(ϕ r (c) ∪ ϕ LL
) = R (ϕ r (c) ∪ ϕ LL
)

i.e.
Therefore, new EΓ .ϕ and new EΓ

.ϕ ′

Rϕ = R ′ϕ
are statically equivalent.

⇐⇒

Rϕ ′ = R ′ϕ ′


Lemma B.26 (Invariant). For all Γ, ϕ P , ϕ P′ , ϕQ , σP , σP′ , σQ , E ′ , cϕ , c σ , for all multisets of processes P, P ′ , Q, where the processes in P,
P ′ , Q are noted {Pi }, {Pi′ }, {Qi }; for all constraint sets {Ci }, if:
• |P | = |Q|
• dom(ϕ P ) = dom(ϕQ )
• ∀i, there is a derivation Πi of Γ ⊢ Pi ∼ Qi → Ci ,
• Γ ⊢ ϕ P ∼ ϕQ : LL → cϕ
• for all i , j, the sets of bound variables in Pi and P j (resp. Qi and Q j ) are disjoint, and similarly for the names
• σP , σQ are ground, and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ ,
z
r
∪∀c σ is consistent,
• (∪×i Ci )∪∀cϕ

σ P , σQ
α
• (EΓ , P, ϕ P , σP ) −−→ (E ′ , P ′, ϕ P′ , σP′ ),
then there exist a word w, a multiset Q ′ = {Qi′ }, constraint sets

such that:
• w =τ α

′ , a substitution σ ′ , an environment Γ ′ , constraints c ′ , and c ′
{Ci′ }, a frame ϕQ
σ
Q
ϕ

|P ′ | = |Q ′ |
for all i , j, the sets of bound variables in Pi′ and P j′ (resp. Qi′ and Q j′ ) are disjoint, and similarly for the bound names;
′ : LL → c ′
Γ ′ ⊢ ϕ P′ ∼ ϕQ
ϕ
′
E = E Γ′
w
′ , σ ′ ),
(EΓ , Q, ϕQ , σQ ) −−−→∗ (EΓ′ , Q ′, ϕQ
Q
∀i, Γ ′ ⊢ Pi′ ∼ Qi′ → Ci′,
σP′ , σQ′ are ground and Γ ′ N, K ⊢ σP′ ∼ σQ′ : Γ ′ X → c σ′ ,
′ ),
dom(ϕ P′ ) = dom(ϕQ
r
z
• (∪×i Ci′)∪∀cϕ′ ′ ′ ∪∀c σ′ is consistent.

•
•
•
•
•
•
•
•

σ P , σQ

Proof. First, we show that it is suﬃcient to prove this lemma in the case where Γ does not contain any union types. Indeed, assume
we know the property holds in that case. Let us show that the lemma then also holds in the other case, i.e. if Γ contains union types. By
hypothesis, σP , σQ are ground, and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence we know by Lemma B.4 that there exists a branch Γ ′′ ∈ branches(Γ)
(thus Γ ′′ does not contain union types), such that (Γ ′′ ) N, K ⊢ σP ∼ σQ : (Γ ′′ ) X → c σ .
Moreover, by Lemma B.7, ∀i, Γ ′′ ⊢ Pi ∼ Qi → Ci′′ ⊆ Ci ; and by Lemma B.5, Γ ′′ ⊢ ϕ P ∼ ϕQ : LL → cϕ . In addition by Lemma B.11,
z
z
r
r
(∪×i Ci′′)∪∀cϕ
∪∀c σ and is therefore consistent. Thus, if the lemma holds when the envi∪∀c σ is a subset of (∪×i Ci )∪∀cϕ
σ P , σQ

σ P , σQ

ronment does not contain union types, it can be applied to the same processes, frames, substitutions and to Γ ′′ , which directly concludes
the proof.
Therefore, we may assume that Γ does not contain any union types.
Note that the assumption on the disjointness of the sets of bound variables (and names) in the processes implies, using Lemma B.8,
that since (∪×i JCi Kσ P , σQ ∪∀c σ ) is consistent (by Lemma B.11), each of the JCi Kσ P , σQ ∪∀c σ is also consistent. Moreover, this disjointness
property for P ′ and Q ′ follows from the other points, as it is easily proved by examining the reduction rules that it is preserved by reduction.

By hypothesis, (EΓ , P, ϕ P , σP ) reduces to (EΓ′ , P ′, ϕ P′ , σP′ ) We know from the form of the reduction rules that exactly one process
Pi ∈ P is reduced, while the others are unchanged. By the assumptions, there is a corresponding process Qi ∈ Q and a derivation Πi of
Γ ⊢ Pi ∼ Q i → C i .
We continue the proof by a case disjunction on the last rule of Πi . Let us ﬁrst consider the cases of the rules PZero, PPar, PNew, and
POr.
• PZero: then Pi = Qi = 0. Hence, the reduction rule applied to P is Zero, and P ′ = P\{Pi }, EP′ = EP , ϕ P′ = ϕ P , and σP′ = σP . The
same reduction can be performed in Q:
τ

(EQ , Q, ϕQ , σQ ) −−→ (EQ , Q\{Qi }, ϕQ , σQ )
Since the other processes, the frames, environments and substitutions do not change in this reduction, all the claims clearly hold in
this case (with cϕ′ = cϕ , c σ′ = c σ ). In particular, the consistency of the constraints follow from the consistency hypothesis. Indeed,
(∪× j,i C j )∪×Ci ∪∀cϕ = (∪× j,i C j )∪× {(∅, Γ)}∪∀cϕ
= (∪× j,i C j )∪∀cϕ ,
since Γ is already contained in the environments appearing in each C j (by Lemma B.12). Thus
r
z
z
r
(∪×j C j′)∪∀cϕ′ ′ ′ ∪×c σ′ = (∪× j C j )∪∀cϕ
∪× c σ
σ P , σQ

σ P , σQ

• PPar: then Pi = Pi1 | Pi2 , Qi = Qi1 | Qi2 . Hence, the reduction rule applied to P is Par:
τ

(EΓ , P, ϕ P , σP ) −−→ (EΓ , P\{Pi } ∪ {Pi1 , Pi2 }, ϕ P , σP ).
We choose Γ ′ = Γ.
In addition
Π1
Πi =

Π2

Γ ⊢ Pi1 ∼ Qi1 → Ci1
Γ ⊢ Pi2 ∼ Qi2 → Ci2
.
Γ ⊢ Pi ∼ Qi → Ci = Ci1 ∪×Ci2

The same reduction rule can be applied to Q:
τ

(EΓ , Q, ϕQ , σQ ) −−→ (EΓ , Q\{Qi } ∪ {Qi1, Qi2 }, ϕQ , σQ )

In this case again, the claims on the substitutions and frames hold since they do not change in the reduction. Moreover the processes
in P ′ and Q ′ are still pairwise typably equivalent. Indeed, all the processes from P and Q are unchanged, except for Pi and Qi which
are reduced to Pi1 , Pi2 , Qi1 , Qi2 , and those are typably equivalent using Π1 and Π2 .
Finally the constraint set is still consistent, since:
r
r
z
z
(∪× j C j′)∪∀cϕ′ ′ ′ ∪∀c σ′ = (∪×j,i C j )∪×Ci1 ∪×Ci2 ∪∀cϕ
∪∀ c σ
σ P , σQ

r

= (∪×j C j )∪∀cϕ

z

σ P , σQ

σ P , σQ

∪∀ c σ

• PNew: then Pi = new n : τnl, a .Pi′ and Qi = new n : τnl, a .Qi′ . Pi is reduced to Pi′ by rule New:
τ

(EΓ , P, ϕ P , σP ) −−→ (EΓ ∪ {n}, P\{Pi } ∪ {Pi′ }, ϕ P , σP ).
In addition

Πi′
Πi =

Γ, n : τnl, a ⊢ Pi′ ∼ Qi′ → Ci
Γ ⊢ Pi ∼ Q i → C i

.

We choose Γ ′ = Γ, n : τnl, a , and we have EΓ′ = EΓ ∪ {n}.
The same reduction rule can be applied to Q:
τ

(EΓ , Q, ϕQ , σQ ) −−→ (EΓ′ , Q\{Qi } ∪ {Qi′ }, ϕQ , σQ )
The claim clearly holds: the processes are still pairwise typable (using Πi′ in the case of Pi′ and Qi′; and Π j for j , i as these processes
are unchanged by the reduction), and all the frames, substitutions, and constraints are unchanged, and since σ , σ ′ are well-typed in
Γ ′ if and only if they are well-typed in Γ.
• POr: this case is not possible, since we have already eliminated the case where Γ contains union types.
In all the other cases for the last rule in Πi , we know that the head symbol of Pi is not | , 0 or new.
Hence, the form of the reduction rules implies that Pi ∈ P is reduced to exactly one process Pi′ ∈ P ′, while the other processes in P do
not change (i.e. P j′ = P j for j , i), and E ′ = EΓ . If we show in each case that the same reduction rule that is applied to Pi can be applied to
reduce Q to a multiset Q ′ by reducing process Qi into Qi′ , we will also have Q j′ = Q j for j , i. Therefore the claim on the cardinality of the
processes multisets will hold.
Since Pi , Qi can be typed and the head symbol of Pi is not new, it is clear by examining the typing rules that the head symbol of Qi is
not new either. Hence, we will choose a Γ ′ containing the same nonces as Γ, and we will have EΓ′ = EΓ .
The proofs for theses cases follow the same structure:
• The typing rule gives us information on the form of Pi and Qi .
• The form of Pi gives us information on which reduction rule was applied to P.
• The form of Qi is the same as Pi . Hence (additional conditions may need to be checked depending on the rule) Qi can be reduced to
some process Qi′ by applying the same reduction rule that was applied to Pi (except in the PIfLR case).
• thus Q can be reduced too, with the same actions as P. We then check the additional conditions on the typing of the processes,
frames and substitutions, and the consistency condition.
First, let us consider the POut case.
• POut: then Pi = out(M).Pi′ and reduces to Pi′ via the Out rule, and Qi = out(N ).Qi′ for some N and Qi′ . In addition
Π′
Π
Πi =

Γ ⊢ Pi′ ∼ Qi′ → Ci′
Γ ⊢ M ∼ N : LL → c
.
Γ ⊢ Pi ∼ Qi → Ci = Ci′∪∀c

We have E ′ = EΓ , σP′ = σP , ϕ P′ = ϕ P ∪ {M/axn }, and α = new axn .out(axn ).
The same reduction rule Out can be applied to reduce the process Qi into Qi′ , hence the claim on the reduction of Q holds. We choose
′ = ϕ ∪ {N /ax }. We also choose c ′ = c ∪ c and c ′ = c . The substitutions σ ,
Γ ′ = Γ. We have EΓ′ = EΓ , σQ′ = σQ , and ϕQ
n
σ
Q
P
ϕ
σ
ϕ
σQ are not extended by the reduction, and the typing environment does not change, which trivially proves the claim regarding the
substitutions.
′ : LL → c ′ .
Moreover, since only M and N are added to the frames in the reduction, Π ′ suﬃces to prove the claim that Γ ⊢ ϕ P′ ∼ ϕQ
ϕ
Since all processes other that Pi and Qi are unchanged by the reduction (and since the typing environment is also unchanged), Π
suﬃces to proves the claim that ∀j. Γ ′ ⊢ P j′ ∼ Q j′ → C j′ (with C j′ = C j for j , i).

r
z
Thus, in this case, it only remains to be proved that (∪× j C j′)∪∀cϕ′

(∪× j,i C j )∪×Ci′∪∀ (cϕ ∪ c)

z

(∪×j,i C j )∪× (Ci′∪∀c)∪∀cϕ

z

r

i.e. to

r

i.e.

′
σ P′ , σQ

r

(∪×j C j )∪∀cϕ

z

σ P , σQ

∪∀c σ′ is consistent. This constraint set is equal to

σ P , σQ

σ P , σQ

∪∀ c σ

∪∀ c σ

∪∀ c σ

which is consistent by hypothesis. Hence the claim holds in this case.
In the remaining cases, from the form of the typing rules for processes, the head symbol of neither Pi nor Qi is out. Thus, the reduction
applied to Pi (from the assumption), as well as the one applied to Qi (we still must show it exists and is the same as for Pi , except in case
PIfLR, where Pi can follow one branch of the conditional while Qi follows the other), cannot be Out. Therefore no new term is output on
′ = ϕ . Hence the claim on the domains of the frames holds by assumption. Moreover, as we will see, in
either side, and ϕ P′ = ϕ P and ϕQ
Q
′
all cases Γ is either Γ, or Γ, x : T where x is a variable declared in (the head of) Pi and Qi , and T is not a union type. The condition that
EΓ = EΓ′ formulated previously will thus hold.
′ : LL → c ′ is then actually that Γ ′ ⊢ ϕ ∼ ϕ : LL → c , which is true by Lemma B.10,
We choose cϕ′ = cϕ . The claim that Γ ′ ⊢ ϕ P′ ∼ ϕQ
P
Q
ϕ
ϕ
since by hypothesis Γ ⊢ ϕ P ∼ ϕQ : LL → cϕ .
Besides, in the cases where we choose Γ ′ = Γ then it is true (by hypothesis) that for j , i, Γ ′ ⊢ P j′ ∼ Q j′ → C j . In the cases where we
choose Γ ′ = Γ, x : T , where x is bound in Pi and Qi , then, since the processes are assumed to use diﬀerent variable names, x does not appear
in P j or Q j (for j , i). Hence, if j , i, using the assumption that Γ ⊢ P j ∼ Q j → C j , by Lemma B.10, we have Γ ′ ⊢ P j′ ∼ Q j′ → C j′ , where
C j′ = {(c, Γc ∪ {x : T })|(c, Γc ) ∈ C j }.
Hence, for each remaining possible last rule of Πi , we only have to show that:
a) The same reduction rule can be applied to Qi as to Pi , with the same action. (Except in the case of the rule PIfLR, as we will see, where
rule If-Then may be applied on one side while rule If-Else is applied on the other side, but this has no inﬂuence on the argument, as
these two rules both represent a silent action, and have a very similar form.)
b) (σP′ , σQ′ ) are ground, and Γ ′ N, K ⊢ σP′ ∼ σQ′ : Γ ′ X → c σ′ for some set of constraints c σ′ . Since at most one variable x is added to the
substitutions in the reduction, we only have to check that condition on this variable, i.e. Γ ′ N, K ⊢ σP′ (x) ∼ σQ′ (x) : Γ ′ (x) → c x for
r z
some c x . We can then choose c σ′ = c σ ∪ c x . As we will see in the proof, we will always have c x ⊆ cϕ
∪ cσ .
σ P , σQ

c) the new processes obtained by reducing Pi and Qi are typably equivalent in Γ ′ , with a constraint Ci′, such that
z
r
(∪×j,i C j )∪×Ci′∪∀cϕ
∪∀ c σ
σ P , σQ

is consistent.
The actual claim, from the statement of the lemma, is that
r
z
(∪×j,i C j′)∪×Ci′∪∀cϕ

′
σ P′ , σQ

∪∀c σ′

is consistent, but we can show that the previous condition is suﬃcient.
In the case where Γ = Γ ′ , we have σP′ = σP , σQ′ = σQ , C j′ = C j for j , i, and c σ′ = c σ . Thus the proposed condition is clearly suﬃcient
(it is even necessary in this case).
In the case where Γ ′ = Γ, x : T for some T which is not a union type, and the substitutions σP′ , σQ′ are σP , σQ extended with a term
associated to x, the proof that the condition is suﬃcient is more involved. First, we show that (∪× j,i C j′)∪×Ci′ = (∪×j,i C j )∪×Ci′.
Indeed, if S denotes the set (∪× j,i C j′)∪×Ci′, we have
Ø Ø
Γj′ ) | ∀j. (c j′ , Γj′ ) ∈ C j′ ∧ ∀j, j ′ . Γj′ and Γj′′ are compatible)}
S = {( c j′ ,
j

= {(ci′ ∪

j

Ø
j,i

c j , Γi′ ∪

Ø
(Γj , x : T ) | (ci′, Γi′ ) ∈ Ci′ ∧ (∀j , i. (c j , Γj ) ∈ C j ) ∧
j,i

(∀j , i, j ′ , i. (Γj , x : T ) and (Γj ′ , x : T ) are compatible) ∧ (∀j , i. Γi′ and (Γj , x : T ) are compatible))}

since we already know that for j , i, C j′ = {(c, Γc ∪ {x : T })|(c, Γc ) ∈ C j }. Assuming we show that Γ, x : T ⊢ Pi′ ∼ Qi′ → Ci′, by
Lemma B.12, we will also have that all the Γi′ appearing in the elements of Ci′ contain x : T (since T is not a union type). Hence:
Ø
Ø
S = {(ci′ ∪
c j , Γi′ ∪ ( Γj ) | (ci′, Γi′ ) ∈ Ci′ ∧ (∀j , i. (c j , Γj ) ∈ C j ) ∧
j,i

j,i

(∀j , i, j ′ , i. Γj and Γj ′ are compatible) ∧ (∀j , i. Γi′ and Γj are compatible))}
= (∪×j,i C j )∪×Ci′

It is thus suﬃcient to ensure the consistency of

r
z
S∪∀cϕ

′
σ P′ , σQ

∪∀ c σ ∪∀ c x ,

i.e., since c σ and c x are ground (since the substitutions are), that
z
r
S∪∀cϕ ∪∀c σ ∪∀c x
is consistent. Using Lemma B.11,

which is equal to

r z
since c x ⊆ cϕ

since σP′

=
sr
z
S∪∀cϕ

σ P , σQ

sr
z
S∪∀cϕ

σ P , σQ

′
σ P′ , σQ

σP ∪ {σP′ (x)/x }

(and similarly for Q), it then suﬃces to show the consistency of
{
∪∀ c σ ∪∀ c x
′ (x )/x
σ P′ (x )/x, σQ

σ P , σQ

∪∀ c σ

{

′ (x )/x
σ P′ (x )/x, σQ

r
z
∪c σ (by point b)). Moreover, as we observed previously, the environments in all elements in S∪∀cϕ

σ P , σQ

∪∀ c σ

contain x : T .
Therefore by Lemma B.11, since ΓN, K ⊢ σP′ (x) ∼ σQ′ (x) : T → c x (as we will show, as point b)), it suﬃces to ensure that
z
r
S∪∀cϕ
∪∀ c σ
σ P , σQ

is consistent,to prove the claim. This is the condition stated at the beginning of this point, since S = (∪×j,i C j )∪×Ci′.
We can now prove the remaining cases for the last rule of Πi , that is to say the cases of the rules PIn, PLet, PLetLR, PIfL, PIfLR, PIfS,
PIfLR*, PIfP, PIfI, PIfLR’*.
• PIn: then Pi = in(x).Pi′ and reduces to Pi′ via the In rule, and Qi = in(x).Qi′ for some Qi′ . In addition
Π
Γ, x : LL ⊢ Pi′ ∼ Qi′ → Ci′
.
Πi =
Γ ⊢ Pi ∼ Qi → Ci = Ci′
We have α = in(R) for some attacker recipe R such that vars(R) ⊆ dom(ϕ P ), and Rϕ P σP ↓, ⊥. We also have E ′ = EΓ , σP′ =
σP ∪ {Rϕ P σP ↓ /x }, ϕ P′ = ϕ P .
The same reduction rule In can be applied to reduce the process Qi into Q ′ . Indeed,
– vars(R) ⊆ dom(ϕQ ) since dom(ϕQ ) = dom(ϕ P ) by hypothesis;
– RϕQrσQ z↓, ⊥. This follows from Lemma B.21, using the fact that by Lemma B.22, ΓN, K ⊢ ϕ P σP ∼ ϕQ σQ : LL → c, for some
c ⊆ cϕ
∪ cσ .
σ P , σQ

Therefore point a) holds.
We choose Γ ′ = Γ, x : LL. We have σQ′ = σQ ∪ {RϕQ σQ ↓ /x }.
Lemmas B.22 and B.21, previously evoked, guarantee that
r z
for some c ′ ⊆ cϕ

σ P , σQ

ΓN, K ⊢ Rϕ P σP ↓∼ RϕQ σQ ↓: LL → c ′
∪ c σ . This proves point b).

Moreover, Π and the fact that
r

(∪×j,i C j )∪×Ci′∪∀cϕ

z

σ P , σQ

z
r
∪∀c σ = (∪× j C j )∪∀cϕ

which is consistent by hypothesis, prove point c) and conclude this case.

σ P , σQ

∪∀ c σ

• PLet: then Pi = let x = d(y) in Pi′ else Pi′′ and Qi = let x = d(y) in Qi′ else Qi′′ for some Pi′ , Pi′′ , Qi′ , Qi′′ . Pi reduces to either Pi′
via the Let-In rule, or Pi′′ via the Let-Else rule. In addition

Πi =

x < dom(Γ)

Π

Π′

Π ′′

Γ ⊢ d(y) : T

Γ, x : T ⊢ Pi′ ∼ Qi′ → Ci′

Γ ⊢ Pi′′ ∼ Qi′′ → Ci′′

Γ⊢

Pi ∼ Qi → Ci = Ci′ ∪ Ci′′

.

We have α = τ .
Since ΓN, K ⊢ σP (y) ∼ σQ (y) : Γ(y) → cy (for some cy ⊆ c σ , by hypothesis), and using Π, by Lemma B.20, we have:
d(σP (y)) ↓, ⊥ ⇐⇒ d(σQ (y)) ↓, ⊥
Therefore, if rule Let-In is applied to Pi then it can also be applied to reduce Qi into Qi′ , and if the rule applied to Pi is Let-Else then it
can also be applied to reduce Qi into Qi′′ . This proves point a). We prove here the Let-In case. The Let-Else case is similar (although
slightly easier, since no new variable is added to the substitutions).
In this case we have σP′ = σP ∪ {d(σP (y)) ↓ /x } and σQ′ = σQ ∪ {d(σQ (y)) ↓ /x }.
By Lemma B.20, we know in this case that there exists c ⊆ cy such that ΓN, K ⊢ d(σP (y)) ↓∼ d(σQ (y)) ↓: T → c. Thus, by Lemma B.2,
there exists T ′ ∈ branches(T ) such that ΓN, K ⊢ d(σP (y)) ↓∼ d(σQ (y)) ↓: T ′ → c.
We choose Γ ′ = Γ, x : T ′ . Since Γ does not contain union types, Γ ′ ∈ branches(Γ, x : T ).
Since c ⊆ cy ⊆ c σ and ΓN, K ⊢ d(σP (y)) ↓∼ d(σQ (y)) ↓: T ′ → c, point b) holds.
We now prove that point c) holds. Using Π ′ , we have Γ, x : T ⊢ Pi′ ∼ Qi′ → Ci′. Hence, by Lemma B.7, there exists Ci′′′ ⊆ Ci′(⊆ Ci )
such that Γ ′ ⊢ Pi′ ∼ Qi′ → Ci′′′ .
Since Ci′′′ ⊆ Ci , we have
r
r
z
z
∪∀ c σ .
∪∀c σ ⊆ (∪×j C j )∪∀cϕ
(∪×j,i C j )∪×Ci′′′ ∪∀cϕ
σ P , σQ

r

σ P , σQ

This last constraint set is consistent by hypothesis. Hence, by Lemma B.11, (∪×j,i C j )∪×Ci′′′ ∪∀cϕ

z

σ P , σQ

∪∀c σ is also consistent.

This proves point c) and concludes this case.
• PLetLR: then Pi = let x = d(y) in Pi′ else Pi′′ and Qi = let x = d(y) in Qi′ else Qi′′ for some Pi′ , Pi′′ , Qi′ , Qi′′ .
Pi reduces to either Pi′ via the Let-In rule, or Pi′′ via the Let-Else rule.
In addition
Π ′′
Πi =

′

l, a
Γ(y) = Jτm
; τnl , a K

Γ ⊢ Pi′′ ∼ Qi′′ → Ci′′
.
Γ ⊢ Pi ∼ Qi → Ci (= Ci′′)

x < dom(Γ)

We have α = τ .
By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence, by deﬁnition of the well-typedness of substitutions, there
′
l, a
exists cy ⊆ c σ such that ΓN, K ⊢ σP (y) ∼ σQ (y) : Jτm
; τnl , a K → cy . Therefore by Lemma B.14, σP (y) = m and σQ (y) = n.
Since m, n are nonces, d(m) ↓= d(n) ↓= ⊥, and we thus have d(σP (y)) ↓= ⊥. Therefore the reduction rule applied to Pi can only be
Let-Else, and Pi is reduced to Pi′′ . Since we also have d(σQ (y)) ↓= ⊥, this rule can also be applied to reduce Qi into Qi′′ . This proves
point a).
We therefore have σP′ = σP and σQ′ = σQ . We choose Γ ′ = Γ.
Since the substitutions and typing environments are unchanged by the reduction, point b) clearly holds.
Moreover, Π ′′ , and the fact that
z
z
r
r
∪∀ c σ
∪∀c σ = (∪× j C j )∪∀cϕ
(∪× j,i C j )∪×Ci′′ ∪∀cϕ
σ P , σQ

σ P , σQ

which is consistent by hypothesis, prove point c) and conclude this case.
• PIfL: then Pi = if M = M ′ then Pi⊤ else Pi⊥ and Qi = if N = N ′ then Qi⊤ else Qi⊥ for some Qi⊤ , Qi⊥ . Pi reduces to Pi′ which is
either Pi⊤ via the If-Then rule, or Pi⊥ via the If-Else rule. In addition
Π⊥

Π⊤
Γ⊢

Pi⊤

∼ Qi⊤

→ Ci⊤

Π
Πi =
We have α = τ , and E ′ = EΓ .

Γ ⊢ M ∼ N : LL → c

Γ⊢

Pi⊥

∼ Qi⊥ → Ci⊥
Π′

Γ ⊢ M ′ ∼ N ′ : LL → c ′

Γ ⊢ Pi ∼ Qi → Ci = (Ci⊤ ∪ Ci⊥ )∪∀ (c ∪ c ′ )

Since Γ ⊢ M ∼ N : LL → c, by Lemma B.22, there exists c ′′ ⊆ JcKσ P , σQ ∪ c σ such that ΓN, K ⊢ MσP ∼ N σQ : LL → c ′′ . Similarly,
there exists c ′′′ ⊆ Jc ′ Kσ P , σQ ∪ c σ such that ΓN, K ⊢ M ′σP ∼ N ′σQ : LL → c ′′′ .
Let ϕ = {MσP /x, M ′σP /y} and ϕ ′ = {N σQ /x, N ′σQ /y}. We then have ΓN, K ⊢ ϕ ∼ ϕ ′ : LL → c ′′ ∪ c ′′′ .
Let us prove that c ∪c ′′′ is consistent in some typing environment. By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ .
Hence, by Lemma B.4, there exists Γ ′′ ∈ branches(Γ) such that Γ ′′ N, K ⊢ σP ∼ σQ : Γ ′′ X → c σ . By Lemma B.13, there exists
(c 1 , Γ ′′′ ) ∈ Ci such that Γ ′′ ⊆ Γ ′′′ . Since Ci = (Ci⊤ ∪ Ci⊥ )∪∀ (c ∪ c ′), c 1 is of the form c 2 ∪ c ∪ c ′ for some c 2 .
As we noted previously, JCi Kσ P , σQ ∪∀c σ is consistent. Therefore, by Lemma B.11, {(Jc ∪ c ′Kσ P , σQ ∪ c σ , Γ ′′′ )} is consistent. Hence,
by the same Lemma, c ′′ ∪ c ′′′ is also consistent in Γ ′′′ .
Thus, by Lemma B.25, ϕ and ϕ ′ are statically equivalent. Hence, in particular, MσP = M ′σP ⇐⇒ N σQ = N ′σQ .
Therefore, if rule If-Then is applied to Pi then it can also be applied to reduce Qi into Qi⊤ , and if the rule applied to Pi is If-Else then
it can also be applied to reduce Qi into Qi⊥ . This proves point a). We prove here the If-Then case. The If-Else case is similar.
We choose Γ ′ = Γ. We have σP′ = σP and σQ′ = σQ .
Since the substitutions and environments do not change in this reduction, point b) trivially holds.
Moreover, by hypothesis,
z
r
(∪× j,i C j )∪× (Ci⊤ ∪ Ci⊥ )∪∀ (c ∪ c ′ ∪ cϕ )

is consistent. Thus by Lemma B.11,

r

(∪×j,i C j )∪× (Ci⊤ ∪ Ci⊥ )∪∀cϕ

σ P , σQ

∪∀ c σ

z

∪∀ c σ
σ P , σQ
N , M ′ ∼ N ′ },

is also consistent. Since, using Ci′ = Ci⊤ and Ci = (Ci⊤ ∪ Ci⊥ )∪∀ {M ∼
z
z
r
r
⊆ (∪×j,i C j )∪× (Ci⊤ ∪ Ci⊥ )∪∀cϕ
(∪× j,i C j )∪×Ci′∪∀cϕ
σ P , σQ

z
r
we have by Lemma B.11 that (∪× j,i C j )∪×Ci′∪∀cϕ

σ P , σQ

σ P , σQ

,

∪∀c σ is consistent. Π⊤ and this fact prove point c) and conclude this case.

• PIfLR: then Pi = if M 1 = M 2 then Pi⊤ else Pi⊥ and Qi = if N 1 = N 2 then Qi⊤ else Qi⊥ for some Qi⊤ , Qi⊥ . Pi reduces to Pi′ which
is either Pi⊤ via the If-Then rule, or Pi⊥ via the If-Else rule. In addition
Π
′

Π
Πi =

′

l ′′, 1
m′

Γ ⊢ M 2 ∼ N 2 : Jτ

;τ

l ′′′, 1
n′

K → c′

l, 1
Γ ⊢ M 1 ∼ N 1 : Jτm
; τnl , 1 K → ∅
?

l ′′, 1

Π ′′
l ′, 1

l, 1
b = (τm
= τm′ )
b ′ = (τn
Γ ⊢ Pi ∼ Qi → Ci = Ci′

?

l ′′′, 1

= τn ′

)

′

Γ ⊢ Pib ∼ Qib → Ci′

We have α = τ in any case.
By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence, by Lemma B.22, using Π, there exists c ′′ such that
′
l, 1
ΓN, K ⊢ M 1 σP ∼ N 1σQ : Jτm
; τnl , 1 K → c ′′ . Therefore by Lemma B.14, M 1σP = m and N 1σQ = n. Similarly we can show that
M 2σP = m ′ and N 2σQ = n ′.
l, 1
l ′′, 1
There are four cases for b and b ′, which are all similar. We write the proof for the case where b = ⊤ and b ′ = ⊥, i.e. τm
= τm
′ and
′

′′′

τnl , 1 , τnl ′ , 1 .
Thus the reduction rule applied to Pi is If-Then and Pi′ = Pi⊤ . On the other hand, rule If-Else can be applied to reduce Qi into Qi′ = Qi⊥ .
This proves point a) (these rules both correspond to silent actions).
We choose Γ ′ = Γ. We have σP′ = σP and σQ′ = σQ .
Since the substitutions and environments do not change in this reduction, point b) trivially holds.
Moreover, Π ′′ and the fact that
z
z
r
r
∪∀ c σ
∪∀c σ = (∪× j C j )∪∀cϕ
(∪×j,i C j )∪×Ci′∪∀cϕ
σ P , σQ

σ P , σQ

prove point c) and conclude this case.
• PIfS: then Pi = if M = M ′ then Pi⊤ else Pi⊥ and Qi = if N = N ′ then Qi⊤ else Qi⊥ for some Qi⊤ , Qi⊥ . Pi reduces to Pi′ which is
either Pi⊤ via the If-Then rule, or Pi⊥ via the If-Else rule. In addition
Π⊥
Πi =
We have α = τ in any case.

Γ⊢

Pi⊥

∼ Qi⊥

Π′

Π
→ Ci′

Γ ⊢ M ∼ N : LL → c
Γ ⊢ Pi ∼ Qi → Ci = Ci′

Γ⊢

M′

∼ N ′ : HH → c ′

By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence, by Lemma B.22, using Π, there exists c ′′ such that
ΓN, K ⊢ MσP ∼ N σQ : LL → c ′′ . Similarly we can show that ΓN, K ⊢ M ′σP ∼ N ′σQ : HH → c ′′′ for some c ′′′ .
Therefore by Lemma B.23, MσP , M ′σP and N σQ , N ′σQ . Hence the reduction for Pi is necessarily If-Else, which is also applicable
to reduce Qi to Qi⊥ . This proves point a).
We choose Γ ′ = Γ. We have σP′ = σP and σQ′ = σQ .
Since the substitutions and typing environments do not change in this reduction, point b) trivially holds.
Moreover, Π ′′ and the fact that
z
z
r
r
∪∀c σ = (∪×j C j )∪∀cϕ
(∪×j,i C j )∪×Ci′∪∀cϕ
σ P , σQ

σ P , σQ

prove point c) and conclude this case.
• PIfI: then Pi = if M = M ′ then Pi⊤ else Pi⊥ and Qi = if N = N ′ then Qi⊤ else Qi⊥ for some Qi⊤ , Qi⊥ . This case is similar to the
PIfS case: the incompatibility of the types of M, N and M ′ , N ′ ensures that the processes can only follow the else branch.
Pi reduces to Pi′ which is either Pi⊤ via the If-Then rule, or Pi⊥ via the If-Else rule. In addition

Πi =

Π′

Π⊥

Π

Γ ⊢ Pi⊥ ∼ Qi⊥ → Ci′

Γ ⊢ M ∼ N : T ∗T′ → c

′

l, a
Γ ⊢ M ′ ∼ N ′ : Jτm
; τnl , a K → c ′

Γ ⊢ Pi ∼ Qi → Ci = Ci′

We have α = τ in any case.
By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence, by Lemma B.22, using Π, there exists c ′′ such that
ΓN, K ⊢ MσP ∼ N σQ : T ∗ T ′ → c ′′ . By Lemma B.17, this implies that MσP and N σQ both are pairs. Similarly we can show that
′
l, a
ΓN, K ⊢ M ′σP ∼ N ′σQ : Jτm
; τnl , a K → c ′′′ for some c ′′′ . By Lemma B.14, this implies that M ′σP = m and N ′σQ = n. Thus neither
of these two terms are pairs.
Therefore MσP , M ′σP and N σQ , N ′σQ . The end of the proof for this case is then the same as for the PIfS case.
• PIfP: then Pi = if M = t then Pi⊤ else Pi⊥ and Qi = if N = t then Qi⊤ else Qi⊥ for some Qi⊤ , Qi⊥ , some messages M, N , and
some t ∈ C ∪ K ∪ N . Pi reduces to Pi′ which is either Pi⊤ via the If-Then rule, or Pi⊥ via the If-Else rule. In addition
Π⊥

Π⊤
Γ⊢
Π
Πi =

Pi⊤

∼ Qi⊤

→ Ci⊤

Γ⊢
Π′

Pi⊥

∼ Qi⊥ → Ci⊥

Γ ⊢ t ∼ t : LL → c ′

Γ ⊢ M ∼ N : LL → c

t ∈ C∪K ∪N

Γ ⊢ Pi ∼ Qi → Ci = Ci⊤ ∪ Ci⊥

We have in any case α = τ .
By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence, by Lemma B.22, using Π, there exists c ′′ ⊆ JcKσ P , σQ ∪ c σ
such that ΓN, K ⊢ MσP ∼ N σQ : LL → c ′′ .
We then show that MσP = t if and only if N σQ = t (note that since t is ground, t = tσP = tσQ ). If MσP = t, then ΓN, K ⊢ t ∼ N σQ :
LL → c ′′ . In all possible cases for t, i.e. t ∈ K, t ∈ N , and t ∈ C, Lemma B.18 implies that N σQ = t. This proves the ﬁrst direction of
the equivalence, the other direction is similar.
Therefore, if rule If-Then is applied to Pi then it can also be applied to reduce Qi into Qi⊤ , and if the rule applied to Pi is If-Else then
it can also be applied to reduce Qi into Qi⊥ . This proves point a). We prove here the If-Then case. The If-Else case is similar.
We choose Γ ′ = Γ. We have σP′ = σP and σQ′ = σQ .
Since the substitutions and typing environments do not change in this reduction, point b) trivially holds.
Moreover, by hypothesis,
z
r
(∪×j,i C j )∪× (Ci⊤ ∪ Ci⊥ )∪∀cϕ
∪∀ c σ
σ P , σQ

is consistent. Since, using Ci′ = Ci⊤ and Ci = (Ci⊤ ∪ Ci⊥ ), we have
r

(∪×j,i C j )∪×Ci′∪∀cϕ

z

σ P , σQ

z
r
∪∀c σ ⊆ (∪×j,i C j )∪× (Ci⊤ ∪ Ci⊥ )∪∀cϕ

r
z
we have by Lemma B.11 that (∪×j,i C j )∪×Ci′∪∀cϕ

σ P , σQ

σ P , σQ

∪∀ c σ ,

∪∀c σ is consistent. This fact proves point c) and concludes this case.

• PIfLR*: then Pi = if M 1 = M 2 then Pi⊤ else Pi⊥ and Qi = if N 1 = N 2 then Qi⊤ else Qi⊥ for some Qi⊤ , Qi⊥ . Pi reduces to Pi′ which
is either Pi⊤ via the If-Then rule, or Pi⊥ via the If-Else rule. In addition
Π′

Π
l ′, ∞

Πi =

l, ∞
Γ ⊢ M 1 ∼ N 1 : Jτm
; τn

l ′, ∞

l, ∞
Γ ⊢ M 2 ∼ N 2 : Jτm
; τn

K → c1

K → c2

Π⊤

Π⊥

Γ ⊢ Pi⊤ ∼ Qi⊤ → Ci⊤

Γ ⊢ Pi⊥ ∼ Qi⊥ → Ci⊥

Γ ⊢ Pi ∼ Qi → Ci = Ci⊤ ∪ Ci⊥

We have α = τ in any case.
By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence, by Lemma B.22, using Π, there exists c ′′ such that
l, ∞
l ′, ∞
ΓN, K ⊢ M 1σP ∼ N 1σQ : Jτm
; τm
K → c ′′ . Therefore by Lemma B.14, M 1σP = m and N 1σQ = n. Similarly we can show that
M 2σP = m and N 2σQ = n.
Hence M 1′ = M 2′ and N 1′ = N 2′.
Thus the reduction rule applied to Pi is If-Then and Pi′ = Pi⊤ . On the other hand, rule If-Then can also be applied to reduce Qi into
Qi′ = Qi⊤ . This proves point a).
Note that we still need to type the other branch, even though it is not used here, as when replicating the process this test may fail if
M 1 , N 1 and M 2 , N 2 are nonces from diﬀerent sessions.
We choose Γ ′ = Γ. We have σP′ = σP and σQ′ = σQ .
Since the substitutions and environments do not change in this reduction, point b) trivially holds.
Moreover, Π ′′ and the fact that, with Ci′ = Ci⊤ ,
r
r
z
z
∪∀ c σ
∪∀c σ ⊆ (∪×j,i C j )∪× (Ci⊤ ∪ Ci⊥ )∪∀cϕ
(∪×j,i C j )∪×Ci′∪∀cϕ
σ P , σQ
σ P , σQ
z
r
∪∀ c σ
= (∪× j C j )∪∀cϕ
σ P , σQ

prove point c) and conclude this case.
• PIfLR’*: then Pi = if M 1 = M 2 then Pi⊤ else Pi⊥ and Qi = if N 1 = N 2 then Qi⊤ else Qi⊥ for some Qi⊤ , Qi⊥ . Pi reduces to Pi′ which
is either Pi⊤ via the If-Then rule, or Pi⊥ via the If-Else rule. In addition
Π
′

Π′
Πi =

l ′′, a
m′

Γ ⊢ M 2 ∼ N 2 : Jτ

;τ

l ′′′, a
n′

l, a
Γ ⊢ M 1 ∼ N 1 : Jτm
; τnl , a K → c 1

K → c2

l ′′, a
m′

l, a
τm
,τ

l ′, a

τn

,τ

Π ′′
l ′′′, a
n′

Γ ⊢ Pi⊥ ∼ Qi⊥ → Ci′

Γ ⊢ Pi ∼ Qi → Ci = Ci′

We have α = τ in any case.
By hypothesis, σP , σQ are ground and ΓN, K ⊢ σP ∼ σQ : ΓX → c σ . Hence, by Lemma B.22, using Π, there exists c ′′ such that
′
l, a
ΓN, K ⊢ M 1 σP ∼ N 1σQ : Jτm
; τnl , a K → c ′′ . Therefore by Lemma B.14, M 1σP = m and N 1σQ = n. Similarly, using Lemma B.14, we
′
can show that M 2 σP = m and N 2σQ = n ′.
′′

l, a
l ,a
′
′
Moreover, since τm
, τm
′ , we know that m , m (by well-formedness of the processes), and similarly n , n .
Hence, M 1σP , M 2σP and N 1σQ , N 2σQ .
Thus the reduction rule applied to Pi is If-Else and Pi′ = Pi⊥ . On the other hand, rule If-Else can also be applied to reduce Qi into
Qi′ = Qi⊥ . This proves point a).
We choose Γ ′ = Γ. We have σP′ = σP and σQ′ = σQ .
Since the substitutions and environments do not change in this reduction, point b) trivially holds.
Moreover, Π ′′ and the fact that
z
r
z
r
(∪×j,i C j )∪×Ci′∪∀cϕ
∪∀c σ = (∪× j C j )∪∀cϕ
∪∀ c σ
σ P , σQ

σ P , σQ

prove point c) and conclude this case.

Theorem B.27 (Typing implies trace inclusion). For all processes P, Q,for all ϕ P , ϕQ , σP , σQ , for all multisets of processes P, Q for all
constraints C, for all sequence s of actions, for all Γ containing only keys,
Γ ⊢ P ∼ Q → C,
and if C is consistent, then
P ⊑t Q

that is, if
s

(∅, {P }, ∅, ∅) −−→∗ (EP , P, ϕ P , σP ),
then there exists a sequence s ′ of actions, a multiset Q, a set of names EQ , a frame ϕQ , a substitution σQ , such that
• s =τ s ′

s′

• (∅, {Q }, ∅, ∅) −−→∗ (EQ , Q, ϕQ , σQ ),
• new EP .ϕ P σP and new EQ .ϕQ σQ are statically equivalent.
Proof. We successively apply Lemma B.26 to each of the reduction steps in the reduction
s

(∅, {P }, ∅, ∅) −−→∗ (EP , P, ϕ P , σP ).
The lemma can indeed be applied successively. At each reduction step of P we obtain a sequence of reduction steps for Q with the same
actions, and the conclusions the lemma provides imply the conditions needed for its next application.
It is clear, for the ﬁrst application, that all the hypotheses of this lemma are satisﬁed.
In the end, we know that there exist Γ ′ , some constraint sets Ci , some cϕ , c σ , and a reduction
s′

(∅, {Q }, ∅, ∅) −−→∗ (EΓ′ , Q, ϕQ , σQ )
with s =τ s ′, such that (among other conclusions)
E P = E Γ′ ,
σP , σQ are ground and Γ ′ N, K ⊢ σP ∼ σQ : Γ ′ X → c σ ,
Γ ′ ⊢ ϕ P ∼ ϕQ : LL → cϕ ,
dom(ϕ P ) = dom(ϕQ ),
∀i, Γ ′ ⊢ Pi ∼ Qi → Ci ,
for
r all i , j, thezsets of bound variables in Pi and P j (resp. Qi and Q j ) are disjoint, and similarly for the bound names;
0.
∪∀c σ is consistent in ∆, EP0 , EQ
• (∪×i Ci )∪∀cϕ
•
•
•
•
•
•

σ P , σQ

Γ′

To prove the claim, it is then suﬃcient to show that new EΓ′ .ϕ P σP and new EΓ′ .ϕQ σQ are statically equivalent.
r z
We have Γ ′ ⊢ ϕ P ∼ ϕQ : LL → cϕ and Γ ′ N, K ⊢ σP ∼ σQ : Γ ′ X → c σ . Hence, by Lemma B.22, there exists c ⊆ cϕ

σ P , σQ

N, K

⊢ ϕ P σP ∼ ϕQ σQ : LL → c.

We will now show that (c, Γ ′ N, K ) is consistent. Since c ⊆
, Γ′

r z
cϕ

σ P , σQ

∪ c σ such that

r z
∪ c σ , by Lemma B.11, it suﬃces to show that ( cϕ

σ P , σQ

∪

N, K ) is consistent.
We have Γ ′ N, K ⊢ σP ∼ σQ : Γ ′ X → c σ . By Lemma B.4, there is a Γ ′′′ ∈ branches(Γ ′ ) such that Γ ′′′ N, K ⊢ σP ∼ σQ : Γ ′′′ X → c σ .
By Lemma B.12, there exists for all i some (ci , Γi′′ ) ∈ Ci such that Γ ′′′ ⊆ Γi′′ . The disjointness condition on the bound variables implies
Ð
def Ð
by Lemma B.8 that for all i, j, Γi′′ and Γj′′ are compatible. Thus ∪×i Ci contains (c ′, Γ ′′ ) = ( i ci , i Γi′′ ). We have Γ ′′′ ⊆ Γ ′′ . Therefore
z
r
r
z
r z
(∪×i Ci )∪∀cϕ
∪∀c σ , which is consistent, contains ( c ′ ∪ cϕ
∪ c σ , Γ ′′ ). Hence, by Lemma B.11, ( cϕ
∪ c σ , Γ ′′ ) is

cσ

σ P , σQ

σ P , σQ

σ P , σQ

consistent.
Therefore, (c, Γ ′′ ) is consistent. Since c is ground, it follows from the deﬁnition of consistency that (c, Γ ′′ N, K ) is also consistent. Moreover,
Γ ′′′ ⊆ Γ ′′ , and Γ ′′′ is a branch of Γ ′ . It is then clear that Γ ′ N, K ⊆ Γ ′′ . Hence, by Lemma B.10, since Γ ′ N, K ⊢ ϕ P σP ∼ ϕQ σQ : LL → c, we
have Γ ′′ ⊢ ϕ P σP ∼ ϕQ σQ : LL → c.
Hence, we have Γ ′′ ⊢ ϕ P σP ∼ ϕQ σQ : LL → c with (c, Γ ′′ N, K ) consistent.
Moreover, ϕ P σP and ϕQ σQ are ground (by well-formedness of the processes).
Therefore, by Lemma B.25, the frames new EΓ′′ .ϕ P σP and new EΓ′′ .ϕQ σQ are statically equivalent.
By deﬁnition of the reduction relation, and by well-formedness of the processes, since
s

(∅, {P }, ∅, ∅) −−→∗ (EΓ′ , P, ϕ P , σP )
and

s′

(∅, {Q }, ∅, ∅) −−→∗ (EΓ′ , Q, ϕQ , σQ )
it is clear that names(ϕ P σP ) ⊆ EΓ′ and names(ϕQ σQ ) ⊆ EΓ′ .
Thus, the only names that are relevant to the frames are EΓ′ .
Hence, new EΓ′ .ϕ P σP and new EΓ′ .ϕQ σQ are statically equivalent.
This theorem corresponds to Theorem 6.1.



Theorem B.28 (Typing implies trace eqivalence). For all Γ containing only keys, for all P and Q, if
Γ ⊢P ∼Q →C
and C is consistent, then
P ≈t Q.
Proof. Theorem B.27 proves that under these assumptions, P ⊑t Q. This is suﬃcient to prove the theorem. Indeed, it is clear from the
typing rules for processes and terms that
Γ ⊢ P ∼ Q → C ⇔ Γ′ ⊢ Q ∼ P → C ′
where C ′ is the constraint obtained from C by swapping the left and right hand sides of all of its elements, and Γ ′ is the environment
obtained from Γ by swapping the left and right types in all reﬁnement types. Clearly from the deﬁnition of consistency, C is consistent
if and only if C ′ is. Therefore, by symmetry, proving that the assumptions imply P ⊑t Q also proves that they imply Q ⊑t P, and thus
P ≈t Q.


B.2

Typing replicated processes

In this subsection, we prove the soundness result for replicated processes.
l, ∞
In this subsection, as well as the following ones, without loss of generality we assume, for each inﬁnite nonce type τm
appearing in the
processes we consider, that N contains an inﬁnite number of fresh names which we will denote by {m i | i ∈ N}; such that the m i do not
appear in the processes or environments considered. We will denote by N0 the set of unindexed names and by Ni the set of indexed names.
We similarly assume that for all the variables x appearing in the processes, the set X of all variables also contains variables {xi | i ∈ N}.
We denote X0 the set of unindexed variables, and Xi the set of indexed variables.
Deﬁnition B.29 (Renaming of a process). For all process P, for all i ∈ N, for all environment Γ, we deﬁne [ P ]iΓ , the renaming of P for
session i with respect to Γ, as the process obtained from P by:
• for each nonce n declared in P by new n : τnl, ∞ , and each nonce n such that Γ(n) = τnl, ∞ for some l, replacing every occurrence of n
with n i , and the declaration new n : τnl, ∞ with new n i : τnl,i1 ;
• replacing every occurence of a variable x with xi .
Lemma B.30 (Typing terms with replicated names). For all Γ, M, N , T and c, if
Γ ⊢ M ∼ N :T →c
then for all i, n ∈ N such that 1 ≤ i ≤ n, for all

Γ′

∈ branches([ Γ ]ni ),
Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : [ T ]n → [ c ]iΓ

Proof. Let Γ, M, N , T , c be such as assumed in the statement of the lemma. Let i, n ∈ N such that 1 ≤ i ≤ n. Let Γ ′ ∈ branches([ Γ ]ni ).
We prove this property by induction on the proof Π of
Γ ⊢ M ∼ N : T → c.
There are several possible cases for the last rule applied in Π.
• TNonce: then M = m and N = p for some m,p ∈ N , T = l for some l ∈ {HH, HL}, and
Π=

l, a
Γ(m) = τm

Γ(p) = τpl, a

Γ ⊢m ∼p :l → ∅

.

It is clear from the deﬁnition of [ Γ ]ni that [ Γ ]ni ([ m ]iΓ ) = τ l, 1 Γ , and that [ Γ ]ni ([ p ]iΓ ) = τ l, 1 Γ . Hence, Γ ′ ([ m ]iΓ ) = τ l, 1
Γ ′ ([ p ]iΓ )

= τ l, 1 Γ .
[ p ]i

[ m ]i

Then, by rule TNonce, we have

Γ′

⊢ [M

]iΓ

∼[N

[ p ]i

]iΓ

[ m ]iΓ

and

: l → ∅ and the claim holds.

TCstFN, TKey, TPubKey, TVKey, THash, THigh, TLR1 :

Similarly to the TNonce case, the claim follows directly from
• TNonceL,
the deﬁnition of [ Γ ]ni , [ M ]iΓ , [ N ]iΓ , [ T ]n and [ c ]iΓ in these cases.
• TEncH: then T = LL and there exist T ′ , k, c ′ such that
Π′
Π=

Γ ⊢ M ∼ N : (T ′ )k → c ′

Γ(k) = keyHH (T ′ )

Γ ⊢ M ∼ N : LL → c = c ′ ∪ {M ∼ N }

.

By applying the induction hypothesis to Π ′, since [ (T ′)k ]n = ([ T ′ ]n )k , there exists a proof Π ′′ of Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : ([ T ′ ]n )k →
[ c ′ ]iΓ

In addition [ Γ ]ni (k) = keyHH ([ T ′ ]n ) by deﬁnition of [ Γ ]ni . Hence Γ ′ (k) = keyHH ([ T ′ ]n ).
Therefore by rule TEncH, we have
 Γ
Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : LL → c ′ i ∪ {[ M ]iΓ ∼ [ N ]iΓ } = [ c ]iΓ

• TPair, TEnc, TEncL, TAenc, TAencH, TAencL, TSignH, TSignL, THashL, TOr: Similarly to the TEncH case, the claim is proved
directly by applying the induction hypothesis to the type judgement appearing in the conditions of the last rule in these cases.
• TVar: then M = N = x for some x ∈ X, and
Π=

Γ(x) = T
Γ ⊢ x ∼x :T → ∅

.

We have [ M ]iΓ = [ N ]iΓ = xi .
Since Γ ′ ∈ branches([ Γ ]ni ), we have Γ ′ (xi ) ∈ branches([ T ]n ).
Hence by rule TVar, Γ ′ ⊢ xi ∼ xi : Γ ′ (xi ) → ∅. Therefore, by rule TOr, we have
Γ ′ ⊢ xi ∼ xi : [ T ]n → ∅
which proves the claim.
• TLR’ (the TLRL’ case is similar): then there exist m,p, l such that T = l, and
Π′
Π=

l, a
Γ ⊢ M ∼ N : Jτm
; τpl, a K → c

Γ ⊢M ∼N :l →c

.

Let us distinguish the case where a is 1 from the case whereh a is ∞.
in
l, a
l, 1
; τpl, a K = Jτm
; τpl, 1 K, we have
If a is 1: by applying the induction hypothesis to Π ′, since Jτm
Thus by rule TLR’, we have

l, a
Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : Jτm
; τpl, a K → [ c ]iΓ .

[ Γ ]ni ⊢ [ M ]iΓ ∼ [ N ]iΓ : l → [ c ]iΓ .
h
in Ô
l, a
l, 1
If a is ∞: by applying the induction hypothesis to Π ′, since Jτm
; τpl, a K = 1≤j ≤n Jτm
; τpl,j 1 K, we have
j
Ü
l, 1
Jτm
; τpl,j 1 K → [ c ]iΓ .
Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ :
j
1≤j ≤n

Thus, by Lemma B.5, there exists j ∈ J1, nK and a proof
′

Γ ⊢ [M

Thus, by rule TLR’,

]iΓ

Π ′′

of

l, 1
∼ [ N ]iΓ : Jτm
; τpl,j 1 K → [ c ]iΓ .
j

Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : l → [ c ]iΓ ,

which proves the claim.
• TLRVar: this case is similar to the TLR’ case, but only the case where a is 1 is possible.
• TSub: then there exists T ′ <: T such that
Π′
Π=

Γ ⊢ M ∼ N :T′ → c

T ′ <: T
.

Γ ⊢ M ∼ N :T →c

By applying the induction hypothesis to Π ′ , we have
 n
Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : T ′
→ [ c ]iΓ .

Since it is clear by induction on the subtyping rules that T ′ <: T implies that [ T ′ ]n <: [ T ]n , rule TSub can be applied and proves
the claim.
′
l, ∞
• TLR∞ : then M = m, N = p, c = ∅, and T = Jτm
; τpl , ∞ K for some m, p ∈ N , c = ∅, and
Π=

l, ∞
Γ(m) = τm

′

Γ(p) = τpl , ∞
′

l, ∞
Γ ⊢ m ∼ p : Jτm
; τpl , ∞ K → ∅

.

′
′
l, 1
l, 1
We have by deﬁnition [ M ]iΓ = m i and [ N ]iΓ = pi , and [ Γ ]ni (m i ) = τm
, and [ Γ ]ni (pi ) = τpl i, 1 . Thus Γ ′ (m i ) = τm
, and Γ ′ (pi ) = τpl i, 1 .
i
i
′

l, 1
Hence by rule TLR1 , we have Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : Jτm
; τpl i, 1 K → ∅.
i
h
in Ô
′
′
l, ∞
l, 1
In addition, Jτm
; τpl , ∞ K = 1≤j ≤n Jτm
; τpl j, 1 K. Therefore, by applying rule TOr, we have
j

h
in
′
l, ∞
Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : Jτm
; τpl , ∞ K
→∅

which proves the claim.


Lemma B.31 (Typing destructors with replicated names). For all Γ, d, x, T , if
Γ ⊢ d(x) : T
then for all i, n ∈ N such that 1 ≤ i ≤ n,
[ Γ ]ni ⊢ d(xi ) : [ T ]n
Proof. Immediate by examining the typing rules for destructors.
Lemma B.32 (Branches and expansion).



• For all T ,
Ø
 n
branches( T ′ ) = branches([ T ]n )

T ′ ∈branches(T )

• For all Γ for all i, n ∈ N,

Ø

Γ′ ∈branches(Γ)

 n
branches( Γ ′ i ) = branches([ Γ ]ni )

Proof. The ﬁrst point is proved by induction on T .
If T = T ′ ∨ T ′′ for some T ′ , T ′′ , then
branches([ T ]n )

=
=

branches([ T ′ ]n ) ∪ branches([ T ′′ ]n )
Ð
Ð
( T ′′′ ∈branches(T ′ ) branches([ T ′′′ ]n )) ∪ ( T ′′′ ∈branches(T ′′) branches([ T ′′′ ]n ))

by the induction hypothesis. Since branches(T ) = branches(T ′) ∪ branches(T ′′ ), this proves the claim.
Otherwise, branches(T ) = {T } and the claim trivially holds.
The second point directly follows from the ﬁrst point, using the deﬁnition of [ Γ ]ni .



Lemma B.33 (Typing processes in all branches). For all P, Q, Γ, {C Γ′ } Γ′ ∈branches(Γ) , if
∀Γ ′ ∈ branches(Γ).
then
Γ ⊢P ∼Q →

Γ ′ ⊢ P ∼ Q → C Γ′
Ø

C Γ′ .

Γ′ ∈branches(Γ)

Consequently if for some C, C Γ′ ⊆ C for all Γ ′ , then there exists C ′ ⊆ C such that
Γ ⊢ P ∼ Q → C ′.
Proof. The ﬁrst point is easily proved by successive applications of rule POr.
The second point is a direct consequence of the ﬁrst point.



Lemma B.34 (Expansion and union).
• For all C, C ′, such that ∀(c, Γ) ∈ C ∪ C ′ . branches(Γ) = {Γ}, i.e. such that Γ does not contain
union types, and names(c) ⊆ dom(Γ) ∪ F N , and Γ only nonce types with names from N0 (i.e. unindexed names), we have
 n

n
C∪×C ′ i = [ C ]ni ∪× C ′ i
• For all C, c, Γ, such that names(c) ⊆ dom(Γ) and ∀(c, Γ ′ ) ∈ C. ΓN, K ⊆ Γ ′ , we have
[ C∪∀c ]ni = [ C ]ni ∪∀ [ c ]iΓ

Proof. The ﬁrst point follows from the deﬁnition of [ · ]ni and ∪× . Indeed, if C, C ′ are as assumed in the claim, we have:
[ C∪×C ′ ]ni

=
=
=
=

{([ c ]iΓ , Γ ′ )|∃Γ. (c, Γ) ∈ C∪×C ′ ∧ Γ ′ ∈ branches([ Γ ]ni )}
{([ c 1 ∪ c 2 ]iΓ1 ∪Γ2 , Γ ′ )|∃Γ1 Γ2 . (c 1 , Γ1 ) ∈ C ∧ (c 2 , Γ2 ) ∈ C ′ ∧ Γ1 , Γ2 are compatible ∧
Γ ′ ∈ branches([ Γ1 ∪ Γ2 ]ni )}
{([ c 1 ]iΓ1 ∪ [ c 2 ]iΓ2 , Γ ′ )|∃Γ1 Γ2 . (c 1 , Γ1 ) ∈ C ∧ (c 2 , Γ2 ) ∈ C ′ ∧ Γ1 , Γ2 are compatible ∧
Γ ′ ∈ branches([ Γ1 ]ni ∪ [ Γ2 ]ni )}
{([ c 1 ]iΓ1 ∪ [ c 2 ]iΓ2 , Γ ∪ Γ ′ )|∃Γ1 Γ2 . (c 1 , Γ1 ) ∈ C ∧ (c 2 , Γ2 ) ∈ C ′ ∧ Γ1 , Γ2 are compatible ∧
Γ ∈ branches([ Γ1 ]ni ) ∧ Γ ′ ∈ branches([ Γ2 ]ni ) ∧ Γ, Γ ′ are compatible}

The last step is proved by directly showing both inclusions.
On the other hand we have:
[ C ]ni ∪× [ C ′ ]ni

{(c ∪ c ′, Γ ∪ Γ ′ )|(c, Γ) ∈ [ C ]ni ∧ (c ′, Γ ′ ) ∈ [ C ′ ]ni ∧ Γ, Γ ′ are compatible}
{([ c 1 ]iΓ1 ∪ [ c 2 ]iΓ2 , Γ ∪ Γ ′ )|∃Γ1 Γ2 . (c 1 , Γ1 ) ∈ C ∧ (c 2 , Γ2 ) ∈ C ′ ∧
Γ ∈ branches([ Γ1 ]ni ) ∧ Γ ′ ∈ branches([ Γ2 ]ni ) ∧ Γ, Γ ′ are compatible}
{([ c 1 ]iΓ1 ∪ [ c 2 ]iΓ2 , Γ ∪ Γ ′ )|∃Γ1 Γ2 . (c 1 , Γ1 ) ∈ C ∧ (c 2 , Γ2 ) ∈ C ′ ∧
Γ ∈ branches([ Γ1 ]ni ) ∧ Γ ′ ∈ branches([ Γ2 ]ni ) ∧ Γ, Γ ′ are compatible ∧ Γ1 , Γ2 are compatible}

=
=
=

This last step comes from the fact that if (c 1 , Γ1 ) ∈ C and (c 2 , Γ2 ) ∈ C ′, then by assumption Γ1 and Γ2 do not contain union types.
This implies that if Γ ∈ branches([ Γ1 ]ni ) and Γ ′ ∈ branches([ Γ2 ]ni ) are compatible, then Γ1 and Γ2 are compatible. Indeed, let x ∈
dom(Γ1 ) ∩ dom(Γ2 ). Hence xi ∈ dom(Γ) ∩ dom(Γ ′ ), and since they are compatible, Γ(xi ) = Γ ′ (xi ). That is to say that there exists
T ∈ branches([ Γ1 (x) ]n ) ∩ branches([ Γ2 (x) ]n ).
′
′
Ô
l, ∞
l, 1
If Γ1 (x) = Jτm
; τpl , ∞ K (for some m, p, l, l ′), then [ Γ1 (x) ]n = 1≤j ≤n Jτm
; τpl j, 1 K, and thus there exists j ∈ J1, nK such that T =
j
′

′

l, 1
l, 1
Jτm
; τpl j, 1 K. Hence, Jτm
; τpl j, 1 K ∈ branches([ Γ2 (x) ]n ). Because of the deﬁnition of [ · ]n , and since Γ2 (x) is not a union type (by assumption),
j
j
′

l, ∞
this implies that Γ2 (x) = Jτm
; τpl , ∞ K, and therefore Γ1 (x) = Γ2 (x).
′

l, ∞
If Γ1 (x) is not of the form Jτm
; τpl , ∞ K (for some m,p, l, l ′), then neither is Γ2 (x) (by contraposition, following the same reasoning as in
the previous case). Γ1 (x) and Γ2 (x) are not of the form T ′ ∨ T ′′ either, by assumption. Therefore, neither [ Γ1 (x) ]n nor [ Γ2 (x) ]n are union
types (from the deﬁnition of [ · ]n ). This implies that T = [ Γ1 (x) ]n = [ Γ2 (x) ]n , which implies Γ1 (x) = Γ2 (x).
In both cases Γ1 (x) = Γ2 (x), and Γ1 , Γ2 are therefore compatible.
Hence [ C ]ni ∪× [ C ′ ]ni = [ C∪×C ′ ]ni , which proves the claim.

The second point directly follows from the deﬁnition of [ · ]ni and ∪∀ . Indeed, for all C, c, Γ satisfying the assumptions, we have:
[ C∪∀c ]ni

′

=
=
=
=
=
=

{([ c ′ ]iΓ , Γ ′′ )|∃Γ ′ . (c ′, Γ ′ ) ∈ C∪∀c ∧ Γ ′′ ∈ branches([ Γ ′ ]ni )}
′
{([ c ′′ ∪ c ]iΓ , Γ ′′ )|∃Γ ′ . (c ′′, Γ ′ ) ∈ C ∧ Γ ′′ ∈ branches([ Γ ′ ]ni )}
′
′
{([ c ′′ ]iΓ ∪ [ c ]iΓ , Γ ′′ )|∃Γ ′ . (c ′′, Γ ′ ) ∈ C ∧ Γ ′′ ∈ branches([ Γ ′ ]ni )}
′
{([ c ′′ ]iΓ ∪ [ c ]iΓ , Γ ′′ )|∃Γ ′ . (c ′′, Γ ′ ) ∈ C ∧ Γ ′′ ∈ branches([ Γ ′ ]ni )}
(since Γ, Γ ′ give the same types to names and keys)
′
{([ c ′ ]iΓ , Γ ′′ )|∃Γ ′ . (c ′, Γ ′ ) ∈ C ∧ Γ ′′ ∈ branches([ Γ ′ ]ni )}∪∀ [ c ]iΓ
[ C ]ni ∪∀ [ c ]iΓ


Theorem B.35 (Typing processes with expanded types). For all Γ, P, Q and C, if
Γ ⊢P ∼Q →C
then for all i, n ∈ N such that 1 ≤ i ≤

n, there exists C ′

⊆ [C

]ni

such that

[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′
Proof. We prove this theorem by induction on the derivation Π of Γ ⊢ P ∼ Q → C. We distinguish several cases for the last rule applied
in this derivation.
• PZero: then P = Q = [ P ]iΓ = [ Q ]iΓ = 0, and C = {(∅, Γ)}. Hence
[ C ]ni = {(∅, Γ ′ ) | Γ ′ ∈ branches([ Γ ]ni )}
Thus, by applying rule POr as many times as necessary to split [ Γ ]ni into all of its branches, followed by rule PZero, we have
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → [ C ]ni .

• POut: then P = out(M).P ′ , Q = out(N ).Q ′ for some messages M, N and some processes P ′ , Q ′ , and
Π′
Π=

Π ′′

Γ ⊢ P′ ∼ Q′ → C′

Γ ⊢ M ∼ N : LL → c
.

Γ ⊢ P ∼ Q → C = C ′ ∪∀ c

By applying the induction hypothesis to Π ′ , there exists C ′′ ⊆ [ C ′ ]ni and a proof Π ′′′ of [ Γ ]ni ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C ′′.
Hence, by Lemma B.7, for all Γ ′ ∈ branches([ Γ ]ni ), there exist C Γ′ ⊆ C ′′ and a proof Π Γ′ of Γ ′ ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C Γ′ .
Moreover, by Lemma B.30, for all Γ ′ ∈ branches([ Γ ]ni ), there exists a proof Π Γ′ ′ of Γ ′ ⊢ [ M ]iΓ ∼ [ N ]iΓ : LL → [ c ]iΓ .
In addition, [ P ]iΓ = [ out(M).P ′ ]iΓ = out([ M ]iΓ ).[ P ′ ]iΓ . Similarly, [ Q ]iΓ = out([ N ]iΓ ).[ Q ′ ]iΓ . Therefore, using Π Γ′ , Π Γ′ ′ and rule
POut, we have for all Γ ′ ∈ branches([ Γ ]ni ) that Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ ∪∀ [ c ]iΓ ⊆ C ′′∪∀ [ c ]iΓ .
Thus by Lemma B.33, there exists C 1 ⊆ C ′′ ∪∀ [ c ]iΓ such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1 .
Finally, [ C ]ni = [ C ′∪∀c ]ni = [ C ′ ]ni ∪∀ [ c ]iΓ (by Lemma B.34, whose conditions are satisﬁed, by Lemma B.12). Hence C ′′∪∀ [ c ]iΓ ⊆
[ C ]ni , which proves the claim.
• PIn: then P = in(x).P ′ , Q = in(x).Q ′ for some variable x and some processes P ′ , Q ′ , and
Π′
Γ, x : LL ⊢ P ′ ∼ Q ′ → C

Π=

.

Γ ⊢P ∼Q →C

Since
[ Γ, x : LL ]ni = [ Γ ]ni , xi : [ LL ]n = [ Γ ]ni , xi : LL,
by applying the induction hypothesis to Π ′ , there exists C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni , xi : LL ⊢ [ P ′ ]iΓ, x :LL ∼ [ Q ′ ]iΓ, x :LL → C ′.
In addition, [ P ]iΓ = [ in(x).P ′ ]iΓ = in(xi ).[ P ′ ]iΓ = in(xi ).[ P ′ ]iΓ, x :LL . Similarly, [ Q ]iΓ = in(xi ).[ Q ′ ]iΓ, x :LL .
Therefore, using Π ′′ and rule PIn, we have [ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′ ⊆ [ C ]ni .
l, a ′
l, a ′
.P , Q = new m : τm
.Q for some m, l, a and some processes P ′, Q ′ , and
• PNew: then P = new m : τm
Π′
Π=
– If a = 1:
Since

h

l, a
Γ, m : τm
⊢ P′ ∼ Q′ → C

Γ ⊢P ∼Q →C

.

i
l, 1
l, 1 n
= [ Γ ]ni , m : τm
,
Γ,m : τm
i

l, 1
Γ,m:τm

l, 1
by applying the induction hypothesis to Π ′ , there exists C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ,m : τm
⊢ [ P ′ ]i
l, 1
Γ,m:τm
[ Q ′ ]i

∼

→ C ′.
l, 1
Γ,m:τm

l, 1
l, 1
In addition [ P ]iΓ = [ new m.P ′ ]iΓ = new m : τm
.[ P ′ ]iΓ = new m : τm
.[ P ′ ]i
n
Γ
Γ
n
′
rule PNew, we have [ Γ ]i ⊢ [ P ]i ∼ [ Q ]i → C ⊆ [ C ]i .
– If a = ∞: Since
i
h
l, 1
l, ∞ n
= [ Γ ]ni ,m i : τm
,
Γ, m : τm
i

; and similarly for Q. Therefore, using Π ′′ and

i

by applying the induction hypothesis to
l, ∞
Γ,m:τm
[ Q ′ ]i

Π ′,

l, ∞
Γ,m:τm

l, 1
there exists C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ,m i : τm
⊢ [ P ′ ]i
i

∼

→ C ′.
l, ∞
Γ,m:τm

l, 1
l, 1
In addition [ P ]iΓ = [ new m.P ′ ]iΓ = new m i : τm
.[ P ′ [m i /m] ]iΓ = new m i : τm
.[ P ′ ]i
i
i
Π ′′ and rule PNew, we have [ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′ ⊆ [ C ]ni .
• PPar: then P = P ′ | P ′′ , Q = Q ′ | Q ′′ for some processes P ′ , Q ′ , P ′′ , Q ′′ , and

Π=

Π′

Π ′′

Γ ⊢ P′ ∼ Q′ → C′

Γ ⊢ P ′′ ∼ Q ′′ → C ′′

Γ ⊢ P ∼ Q → C = C ′∪×C ′′

.

; and similarly for Q. Therefore, using

By applying the induction hypothesis to Π ′, there exists C ′′′ ⊆ [ C ′ ]ni and a proof Π ′′′ of [ Γ ]ni ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C ′′′. Similarly,
by applying the induction hypothesis to Π ′′ , there exists C ′′′′ ⊆ [ C ′′ ]ni and a proof Π ′′′′ of [ Γ ]ni ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C ′′′′ .
In addition, [ P ]iΓ = [ P ′ | P ′′ ]iΓ = [ P ′ ]iΓ | [ P ′′ ]iΓ . Similarly, [ Q ]iΓ = [ Q ′ | Q ′′ ]iΓ = [ Q ′ ]iΓ | [ Q ′′ ]iΓ . Finally, [ C ]ni = [ C ′∪×C ′′ ]ni =
[ C ′ ]ni ∪× [ C ′′ ]ni , by Lemma B.34 (using Lemma B.9 to ensure the condition that the environments do not contain union types).
Therefore, using Π ′′′ , Π ′′′′ and rule PPar, we have [ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′′′∪×C ′′′′ ⊆ [ C ]ni .
• POr: then Γ = Γ ′, x : T ∨ T ′ for some Γ ′ , some x ∈ X and some types T , T ′ , and

Π=

ΠT

ΠT ′

Γ ′, x : T ⊢ P ∼ Q → C ′

Γ ′ , x : T ′ ⊢ P ∼ Q → C ′′
.

Γ ⊢ P ∼ Q → C = C ′ ∪ C ′′

′
′
By applying the induction hypothesis to ΠT , there exist C 1 ⊆ [ C ′ ]ni and a proof Π1 of [ Γ ′ ]ni , xi : [ T ]n ⊢ [ P ]iΓ , x :T ∼ [ Q ]iΓ , x :T →

′
′
′
′
C 1 . Similarly with ΠT ′ , there exist C 2 ⊆ [ C ′′ ]ni and a proof Π2 of [ Γ ′ ]ni , xi : [ T ′ ]n ⊢ [ P ]iΓ , x :T ∼ [ Q ]iΓ , x :T → C 2 .
′

′

′

In addition [ P ]iΓ = [ P ]iΓ , x :T = [ P ]iΓ , x :T , and similarly for Q.
Thus by rule POr, we have
 ′ n
 n
 n 
n
Γ i , xi : [ T ]n ∨ T ′
⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1 ∪ C 2 ⊆ C ′ i ∪ C ′′ i = [ C ]ni .
Since [ Γ ]ni = [ Γ ′, x : T ∨ T ′ ]ni = [ Γ ′ ]ni , xi : [ T ]n ∨ [ T ′ ]n , this proves the claim in this case.
• PLet: then P = let x = d(y) in P ′ else P ′′ , Q = let x = d(y) in Q ′ else Q ′′ for some variable x and some processes P ′ , Q ′ , P ′′ ,
Q ′′ , and
Π ′′
Π′
Πd
Π=

Γ, x : T ⊢ P ′ ∼ Q ′ → C ′

Γ ⊢ d(y) : T

Γ ⊢ P ′′ ∼ Q ′′ → C ′′

Γ ⊢ P ∼ Q → C = C ′ ∪ C ′′

.

Since
[ Γ, x : T ]ni = [ Γ ]ni , xi : [ T ]n ,
by applying the induction hypothesis to Π ′ , there exist C ′′′ ⊆ [ C ′ ]ni and a proof Π ′′′ of [ Γ ]ni , xi : [ T ]n ⊢ [ P ′ ]iΓ, x :T ∼ [ Q ′ ]iΓ, x :T →
C ′′′ . Similarly, there exist C ′′′′ ⊆ [ C ′′ ]ni and a proof Π ′′′′ of [ Γ ]ni ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C ′′′′ .
By Lemma B.31 applied to Πd , we also have
[ Γ ]ni ⊢ d(yi ) : [ T ]n
In addition, [ P ]iΓ = [ let x = d(y) in P ′ else P ′′ ]iΓ = let xi = d(yi ) in [ P ′ ]iΓ else [ P ′′ ]iΓ = let xi = d(yi ) in [ P ′ ]iΓ, x :T else [ P ′′ ]iΓ .
Similarly, [ Q ]iΓ = let xi = d(yi ) in [ Q ′ ]iΓ, x :T else [ Q ′′ ]iΓ .
Therefore, using Π ′′ and rule PLet, we have [ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′′′ ∪ C ′′′′ ⊆ [ C ]ni .
• PLetLR: then P = let x = d(y) in P ′ else P ′′ , Q = let x = d(y) in Q ′ else Q ′′ for some variable x ∈ X∗ and some processes P ′ ,
Q ′, P ′′ , Q ′′ , and
Π′
′

Π=

l, a
Γ(y) = Jτm
; τpl , a K

Γ ⊢ P ′′ ∼ Q ′′ → C

Γ ⊢P ∼Q →C
for some m, p.
By applying the induction hypothesis to Π ′ , there exists C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C ′.
We have [ P ]iΓ = [ let x = d(y) in P ′ else P ′′ ]iΓ = let xi = d(yi ) in [ P ′ ]iΓ else [ P ′′ ]iΓ . Similarly, [ Q ]iΓ = let xi =
d(yi ) in [ Q ′ ]iΓ else [ Q ′′ ]iΓ .
′
l, a
We distinguish two cases, depending on whether the types in the reﬁnement Jτm
; τpl , a K are ﬁnite nonce types or inﬁnite nonce
types, i.e. whether a is 1 or ∞.
′
l, 1
; τpl , 1 K.
– If a is 1: Then by deﬁnition of [ Γ ]ni , we have [ Γ ]ni (yi ) = Jτm
Therefore, using Π ′′ and rule PLetLR, we have [ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′ ⊆ [ C ]ni .
′
Ô
l, 1
– If a is ∞: Then by deﬁnition of [ Γ ]ni , we have [ Γ ]ni (yi ) = 1≤j ≤n Jτm
; τpl j, 1 K. Let Γ ′ ∈ branches([ Γ ]ni ). By deﬁnition, there
j
′

l, 1
exists j ∈ J1, nK, such that Γ ′ (yi ) = Jτm
; τpl j, 1 K.
j

Using Π ′′ and Lemma B.7, there exist C Γ′ ′ ⊆ [ C ]ni and a derivation Π Γ′′′ of Γ ′ ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C Γ′ ′ .
Therefore, using rule PLetLR, we have, for all Γ ′ ∈ branches([ Γ ]ni ), Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ ′ ⊆ [ C ]ni . Thus, by Lemma B.33,
we have
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′′,

where C ′′ ⊆ [ C ]ni , which proves the claim in this case.
• PIfL: then P = if M = M ′ then P ′ else P ′′ , Q = if N = N ′ then Q ′ else Q ′′ for some messages M, N , M ′ , N ′ , and some
processes P ′ , Q ′ , P ′′ , Q ′′ , and

Π=

Π′

Π ′′

Π1

Π2

Γ ⊢ P′ ∼ Q′ → C′

Γ ⊢ P ′′ ∼ Q ′′ → C ′′

Γ ⊢ M ∼ N : LL → c

Γ ⊢ M ′ ∼ N ′ : LL → c ′
.

Γ ⊢ P ∼ Q → C = (C ′ ∪ C ′′ )∪∀ (c ∪ c ′ )

By applying the induction hypothesis to Π ′, there exists C ′′′ ⊆ [ C ′ ]ni and a proof Π ′′′ of [ Γ ]ni ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C ′′′. Similarly,
there exists C ′′′′ ⊆ [ C ′′ ]ni and a proof Π ′′′′ of [ Γ ]ni ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C ′′′′ .
Hence, by Lemma B.7, for all Γ ′ ∈ branches([ Γ ]ni ), there exist C Γ′ ⊆ C ′′′ and a proof Π1, Γ′ of Γ ′ ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C Γ′ ; as well
as C Γ′ ′ ⊆ C ′′′′ and a proof Π2, Γ′ of Γ ′ ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C Γ′ ′ .
Γ
Γ
Γ
′
′
Moreover, by Lemma B.30, for all Γ ′ ∈ branches([ Γ ]ni ), there exists a proof Π1,
Γ′ of Γ ⊢ [ M ]i ∼ [ N ]i : LL → [ c ]i . Similarly,
′
′
′ Γ
′ Γ
′ Γ
there exists a proof Π2,
Γ′ of Γ ⊢ [ M ]i ∼ [ N ]i : LL → [ c ]i .

In addition, [ P ]iΓ = [ if M = M ′ then P ′ else P ′′ ]iΓ = if [ M ]iΓ = [ M ′ ]iΓ then [ P ′ ]iΓ else [ P ′′ ]iΓ . Similarly, [ Q ]iΓ = if [ N ]iΓ =
[ N ′ ]iΓ then [ Q ′ ]iΓ else [ Q ′′ ]iΓ .
′ , Π′
Therefore, using Π1, Γ′ , Π2, Γ′ , Π1,
Γ′
2, Γ′ and rule PIfL, we have
 Γ
 Γ
Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → (C Γ′ ∪ C Γ′ ′ )∪∀ ([ c ]iΓ ∪ c ′ i ) ⊆ (C ′′′ ∪ C ′′′′ )∪∀ ([ c ]iΓ ∪ c ′ i ).

Thus by Lemma B.33, there exists C 1 ⊆ (C ′′′ ∪ C ′′′′ )∪∀ ([ c ]iΓ ∪ [ c ′ ]iΓ ) such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1 .

Finally, [ C ]ni = [ (C ′ ∪ C ′′)∪∀ (c ∪ c ′ ) ]ni = ([ C ′ ]ni ∪ [ C ′′ ]ni )∪∀ ([ c ]iΓ ∪ [ c ′ ]iΓ ) (by Lemma B.34, whose conditions are satisﬁed, by
Lemma B.12). Hence (C ′′′ ∪ C ′′′′ )∪∀ ([ c ]iΓ ∪ [ c ′ ]iΓ ) ⊆ [ C ]ni , which proves the claim.
• PIfP: then P = if M = t then P ′ else P ′′ , Q = if N = t then Q ′ else Q ′′ for some messages M, N , some t ∈ K ∪ N ∪ C, and
some processes P ′ , Q ′ , P ′′ , Q ′′ , and
Π ′′

Π′
′

Π=

′

Γ ⊢P ∼Q →C

′

Γ⊢P

′′

′′

∼Q →C

′′

Γ ⊢P ∼Q →C

Π1

Π2

Γ ⊢ M ∼ N : LL → c

Γ ⊢ t ∼ t : LL → c ′

= C ′ ∪ C ′′

.

By applying the induction hypothesis to Π ′, there exist C ′′′ ⊆ [ C ′ ]ni and a proof Π ′′′ of [ Γ ]ni ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C ′′′. Similarly,
there exist C ′′′′ ⊆ [ C ′′ ]ni and a proof Π ′′′′ of [ Γ ]ni ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C ′′′′ .
Hence, by Lemma B.7, for all Γ ′ ∈ branches([ Γ ]ni ), there exist C Γ′ ⊆ C ′′′ and a proof Π1, Γ′ of Γ ′ ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C Γ′ ; as well
as C Γ′ ′ ⊆ C ′′′′ and a proof Π2, Γ′ of Γ ′ ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C Γ′ ′ .
Γ
Γ
Γ
′
′
Moreover, by Lemma B.30, for all Γ ′ ∈ branches([ Γ ]ni ), there exists a proof Π1,
Γ′ of Γ ⊢ [ M ]i ∼ [ N ]i : LL → [ c ]i . Similarly,
Γ
Γ
′
′
′ Γ
there exists a proof Π2,
Γ′ of Γ ⊢ [ t ]i ∼ [ t ]i : LL → [ c ]i .

Since t ∈ K ∪ N ∪ C, we also have [ t ]iΓ ∈ K ∪ N ∪ C.
In addition, [ P ]iΓ = [ if M = M ′ then P ′ else P ′′ ]iΓ = if [ M ]iΓ = [ M ′ ]iΓ then [ P ′ ]iΓ else [ P ′′ ]iΓ . Similarly, [ Q ]iΓ = if [ N ]iΓ =
[ N ′ ]iΓ then [ Q ′ ]iΓ else [ Q ′′ ]iΓ .
n
′ , Π′
′
Therefore, using Π1, Γ′ , Π2, Γ′ , Π1,
Γ′
2, Γ′ and rule PIfP, we have for all Γ ∈ branches([ Γ ]i )
Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ ∪ C Γ′ ′ ⊆ C ′′′ ∪ C ′′′′ .
Thus by Lemma B.33, there exists C 1 ⊆ (C ′′′ ∪ C ′′′′ ) such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1 .
Finally, [ C ]ni = [ C ′ ∪ C ′′ ]ni = [ C ′ ]ni ∪ [ C ′′ ]ni (by Lemma B.34). Hence (C ′′′ ∪ C ′′′′ ) ⊆ [ C ]ni , which proves the claim.

• PIfLR: then P = if M 1 = M 2 then P⊤ else P⊥ , Q = if N 1 = N 2 then Q ⊤ else Q ⊥ for some messages M 1 , N 1 , M 2 , N 2 , and some
processes P⊤ , Q ⊤ , P⊥ , Q ⊥ , and there exist m, p, m ′, p ′ such that
Π1
′

Π2
Γ ⊢ M2 ∼ N2 :
Π=

l ′′, 1
l ′′′, 1
Jτm
K
′ ; τp ′

→ c′

l, 1
Γ ⊢ M 1 ∼ N 1 : Jτm
; τpl , 1 K → c
?

l ′′, 1
m′

l, 1
b = (τm
=τ

)

Π′
l ′′, 1

b ′ = (τp

l ′′′, 1
p′

?

=τ

)

Γ ⊢ Pb ∼ Qb ′ → C
.

Γ ⊢P ∼Q →C

By applying the induction hypothesis to Π ′ , there exist C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ⊢ [ Pb ]iΓ ∼ [ Qb ′ ]iΓ → C ′.
Hence, by Lemma B.7, for all Γ ′ ∈ branches([ Γ ]ni ), there exist C Γ′ ⊆ C ′, and a proof Π Γ′ of Γ ′ ⊢ [ Pb ]iΓ ∼ [ Qb ′ ]iΓ → C Γ′ .
Γ
Γ
′
′
Moreover, by Lemma B.30 applied to Π1 , for all Γ ′ ∈ branches([ Γ ]ni ), there exists a proof Π1,
Γ′ of Γ ⊢ [ M 1 ]i ∼ [ N 1 ]i :
′
l, 1
l ′′, 1
l ′′′, 1
Γ
Γ
′
′
′ Γ
Jτm
; τpl , 1 K → [ c ]iΓ . Similarly, there exists a proof Π2,
Γ′ of Γ ⊢ [ M 2 ]i ∼ [ N 2 ]i : Jτm′ ; τp ′ K → [ c ]i .

In addition, [ P ]iΓ = [ if M 1 = M 2 then P⊤ else P⊥ ]iΓ = if [ M 1 ]iΓ = [ M 2 ]iΓ then [ P⊤ ]iΓ else [ P⊥ ]iΓ . Similarly, [ Q ]iΓ =
if [ N 1 ]iΓ = [ N 2 ]iΓ then [ Q ⊤ ]iΓ else [ Q ⊥ ]iΓ .
n
′ , Π′
′
Therefore, using Π Γ′ , Π1,
Γ′
2, Γ′ and rule PIfLR, we have for all Γ ∈ branches([ Γ ]i )
Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ ⊆ C ′ ⊆ [ C ]ni .
Thus by Lemma B.33, there exists C 1 ⊆ [ C ]ni such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1,
which proves the claim.
• PIfS: then P = if M = M ′ then P ′ else P ′′ , Q = if N = N ′ then Q ′ else Q ′′ for some messages M, N , M ′ , N ′ , and some
processes P ′ , Q ′ , P ′′ , Q ′′ , and
Π′
′′

Π=

Γ ⊢P ∼Q

Π1
′′

→C

Π2
′

Γ ⊢ M ∼ N ′ : HH → c ′

Γ ⊢ M ∼ N : LL → c

.

Γ ⊢P ∼Q →C

By applying the induction hypothesis to Π ′ , there exists C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C ′.
Hence, by Lemma B.7, for all Γ ′ ∈ branches([ Γ ]ni ), there exist C Γ′ ⊆ C ′ and a proof Π Γ′ of Γ ′ ⊢ [ P ′ ]iΓ ∼ [ Q ′ ]iΓ → C Γ′ .
Γ
Γ
Γ
′
′
Moreover, by Lemma B.30, for all Γ ′ ∈ branches([ Γ ]ni ), there exists a proof Π1,
Γ′ of Γ ⊢ [ M ]i ∼ [ N ]i : LL → [ c ]i . Similarly,
′
′
′ Γ
′ Γ
′ Γ
there exists a proof Π2,
Γ′ of Γ ⊢ [ M ]i ∼ [ N ]i : HH → [ c ]i .

In addition, [ P ]iΓ = [ if M = M ′ then P ′ else P ′′ ]iΓ = if [ M ]iΓ = [ M ′ ]iΓ then [ P ′ ]iΓ else [ P ′′ ]iΓ . Similarly, [ Q ]iΓ = if [ N ]iΓ =
[ N ′ ]iΓ then [ Q ′ ]iΓ else [ Q ′′ ]iΓ .
n
′
′ , Π′
Therefore, using Π Γ′ , Π1,
Γ′
2, Γ′ and rule PIfS, we have for all Γ ∈ branches([ Γ ]i )
Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ ⊆ C ′ ⊆ [ C ]ni .
Thus by Lemma B.33, there exists C 1 ⊆ [ C ]ni such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1,
which proves the claim.
• PIfI: then P = if M = M ′ then P ′ else P ′′ , Q = if N = N ′ then Q ′ else Q ′′ for some messages M, N , M ′ , N ′, and some
processes P ′ , Q ′ , P ′′ , Q ′′ , and there exist types T , T ′ , and names m, p, such that
Π′
Π=

Γ ⊢ P ′′ ∼ Q ′′ → C

Π1

Π2

Γ ⊢ M ∼ N : T ∗T′ → c

l, a
Γ ⊢ M ∼ N : Jτm
; τpl , a K → c ′

Γ ⊢P ∼Q →C

′

′

′

.

By applying the induction hypothesis to Π ′ , there exist C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ⊢ [ P ′′ ]iΓ ∼ [ Q ′′ ]iΓ → C ′.
Let Γ ′ ∈ branches([ Γ ]ni ). By applying Lemma B.7 to Π ′′ , there exists C Γ′ ⊆ C ′, such that there exists a proof Π Γ′ of Γ ′ ⊢ [ P ′′ ]iΓ ∼
[ Q ′′ ]iΓ → C Γ′ .
Γ
Γ
n
Γ
′
′
′ n
Moreover, by Lemma B.30 applied to Π1 , there exists a proof Π1,
′ of Γ ⊢ [ M ]i ∼ [ N ]i : [ T ] ∗ [ T ] → [ c ]i . Similarly, there
h
in Γ
′
l, a
l ,a
′
′
′ Γ
′ Γ
exists a proof Π2,
) → [ c ′ ]iΓ .
Γ′ of Γ ⊢ [ M ]i ∼ [ N ]i : Jτm ; τp K

In addition, [ P ]iΓ = [ if M = M ′ then P ′ else P ′′ ]iΓ = if [ M ]iΓ = [ M ′ ]iΓ then [ P ′ ]iΓ else [ P ′′ ]iΓ . Similarly, [ Q ]iΓ = if [ N ]iΓ =
[ N ′ ]iΓ then [ Q ′ ]iΓ else [ Q ′′ ]iΓ .
We distinguish two
h cases.
i
′

l, 1
– If a is 1: Then Jτm
; τpl , 1 K

n

′

l, 1
n
′ , Π′
′
= Jτm
; τpl , 1 K, and using Π Γ′ , Π1,
Γ′
2, Γ′ and rule PIfI, we have for all Γ ∈ branches([ Γ ]i )

Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ ⊆ C ′ ⊆ [ C ]ni .

Thus by Lemma B.33, there exists C 1 ⊆ [ C ]ni such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1,
which proves the claim in this case.
h
in
′ , there exists a type T ′′ ∈ branches( Jτ l, ∞ ; τ l ′, ∞ K
), such that there exists
– If a is ∞: Moreover, by applying Lemma B.5 to Π2,
m
p
Γ′

′′ of Γ ′ ⊢ [ M ′ ]Γ ∼ [ N ′ ]Γ : T ′′ → [ c ′ ]Γ .
a proof Π2,
i
i
Γ′ h
in i Ô
′
′
l, ∞
l, 1
By deﬁnition, Jτm
; τpl , ∞ K
= 1≤j ≤n Jτm
;
τpl j, 1 K. Therefore, by deﬁnition of branches, there exists j such that T ′′ =
j
′

l, 1
Jτm
; τpl j, 1 K.
j
′ , Π ′′ , by applying rule PIfI, we have for all Γ ′ ∈ branches([ Γ ]n ) that
Hence, using Π Γ′ , Π1,
i
Γ′
2, Γ′

Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ ⊆ C ′ ⊆ [ C ]ni .
Thus by Lemma B.33, there exists C 1 ⊆ [ C ]ni such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1
which proves the claim in this case.
• PIfLR*: then P = if M 1 = M 2 then P⊤ else P⊥ , Q = if N 1 = N 2 then Q ⊤ else Q ⊥ for some messages M 1 , N 1 , M 2 , N 2 , and some
processes P⊤ , Q ⊤ , P⊥ , Q ⊥ , and there exist m,p, l, l ′ such that
Π2

Π1
Π=

Γ ⊢ M1 ∼ N1 :

l ′, ∞

l, ∞
Jτm
; τp

Π⊤

Π⊥

Γ ⊢ P⊤ ∼ Q ⊤ → C 1

Γ ⊢ P⊥ ∼ Q ⊥ → C 2

′

l, ∞
Γ ⊢ M 2 ∼ N 2 : Jτm
; τpl ′, ∞ K → ∅

K→∅

Γ ⊢ P ∼ Q → C = C1 ∪ C2

.

By applying the induction hypothesis to Π⊤ , there exist C ′ ⊆ [ C 1 ]ni ⊆ [ C ]ni and a proof Π ′ of [ Γ ]ni ⊢ [ P⊤ ]iΓ ∼ [ Q ⊤ ]iΓ → C ′.
Similarly with Π⊥ , there exist C ′′ ⊆ [ C 2 ]ni ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ⊢ [ P⊥ ]iΓ ∼ [ Q ⊥ ]iΓ → C ′′.
Hence, by Lemma B.7, for all Γ ′ ∈ branches([ Γ ]ni ), there exist C 1, Γ′ ⊆ C ′(⊆ [ C ]ni ), C 2, Γ′ ⊆ C ′′(⊆ [ C ]ni ), and proofs Π⊤, Γ′ and Π⊥, Γ′
of Γ ′ ⊢ [ P⊤ ]iΓ ∼ [ Q ⊤ ]iΓ → C 1, Γ′ and Γ ′ ⊢ [ P⊥ ]iΓ ∼ [ Q ⊥ ]iΓ → C 2, Γ′ .
Γ
Γ
′
′
Moreover, by Lemma B.30 applied to Π1 , for all Γ ′ ∈ branches([ Γ ]ni ), there exists a proof Π1,
Γ′ of Γ ⊢ [ M 1 ]i ∼ [ N 1 ]i :
′
′
Ô
Ô
l, 1
l ,1
l, 1
l ,1
Γ
Γ
Γ
′
′
′ Γ
1≤j ≤n Jτm j ; τp j K → [ c ]i . Similarly, there exists a proof Π 2, Γ′ of Γ ⊢ [ M 2 ]i ∼ [ N 2 ]i : 1≤j ≤n Jτm j ; τp j K → [ c ]i .
′, 1
Ô
l,
1
l
′′ of
Let Γ ′ ∈ branches([ Γ ]ni ). By Lemma B.5, there exists T ∈ branches( 1≤j ≤n Jτm j ; τp j K) such that there exists a proof Π1,
Γ′
Γ ′ ⊢ [ M 1 ]iΓ ∼ [ N 1 ]iΓ : T → [ c ]iΓ .
′
Ô
l, 1
′′ of Γ ′ ⊢ [ M ]Γ ∼ [ N ]Γ : T ′ → [ c ]Γ .
Similarly, there exists T ′ ∈ branches( 1≤j ≤n Jτm
; τpl j, 1 K) such that there exists a proof Π2,
2 i
2 i
i
j
Γ′
′

′

l, 1
l, 1
By deﬁnition of branches, there exist j, j ′ such that T = Jτm
; τpl j, 1 K and T ′ = Jτm
; τpl j,′1 K.
j
j′
In addition, [ P ]iΓ = [ if M 1 = M 2 then P⊤ else P⊥ ]iΓ = if [ M 1 ]iΓ = [ M 2 ]iΓ then [ P⊤ ]iΓ else [ P⊥ ]iΓ . Similarly, [ Q ]iΓ =
if [ N 1 ]iΓ = [ N 2 ]iΓ then [ Q ⊤ ]iΓ else [ Q ⊥ ]iΓ .
′′ , Π ′′ and rule PIfLR, either j = j ′ and we have
Therefore, using Π⊤, Γ′ , Π⊥, Γ′ , Π1,
2, Γ′
Γ′

Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 1, Γ′ (⊆ [ C ]ni )
or j , j ′ and we have
Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C 2, Γ′ (⊆ [ C ]ni ).
Γ′

]ni ).

This holds for any ∈ branches([ Γ
Thus by Lemma B.33, there exists C ′ ⊆ [ C ]ni such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′
which proves the claim in this case.

• PIfLR’*: then P = if M 1 = M 2 then P⊤ else P⊥ , Q = if N 1 = N 2 then Q ⊤ else Q ⊥ for some messages M 1 , N 1 , M 2 , N 2 , and some
processes P⊤ , Q ⊤ , P⊥ , Q ⊥ , and there exist names m,p,m ′, p ′ such that
Π2

Π1
Π=

Γ ⊢ M1 ∼ N1 :

l, a
Jτm

;

′
τpl , a K

Γ ⊢ M2 ∼ N2 :

→∅

′′′ ′
l ′′, a ′
; τpl ′ , a K
Jτm
′

Π′
→∅

Γ ⊢ P⊥ ∼ Q ⊥ → C

Γ ⊢P ∼Q →C

.

By applying the induction hypothesis to Π ′ , there exist C ′ ⊆ [ C ]ni and a proof Π ′′ of [ Γ ]ni ⊢ [ P⊥ ]iΓ ∼ [ Q ⊥ ]iΓ → C ′.
Hence, by Lemma B.7, for all Γ ′ ∈ branches([ Γ ]ni ), there exist C Γ′ ⊆ C ′(⊆ [ C ]ni ), and a proofsΠ Γ′ of Γ ′ ⊢ [ P⊥ ]iΓ ∼ [ Q ⊥ ]iΓ → C Γ′ .
′
′ ⊢ [ M ]Γ ∼ [ N ]Γ :
Moreover, by Lemma B.30 applied to Π1 , for all Γ ′ ∈ branches([ Γ ]ni ), there exists a proof Π1,
1 i
1 i
′ of Γ
h
in
h ′′ ′ Γ′′′ ′ i n
′
l, a
l ,a
l ,a
l ,a
Γ
Γ
Γ
Γ
′
′
′
Jτm ; τp K → [ c ]i . Similarly, there exists a proof Π2, Γ′ of Γ ⊢ [ M 2 ]i ∼ [ N 2 ]i : Jτm′ ; τp ′ K
→ [ c ]i .
We distinguish several cases, depending on a and a ′.
– if a and a ′ are both 1: Then this rule is a particular case of rule PIfLR, and the result is proved in a similar way.
h
in h
in
h ′′
i
′
′
Ô
l, a
l, 1
l ,a
l ′′′, a n
l ′′, 1
l ′′′, 1
– if a is 1 and a ′ is ∞: Then Jτm
; τpl , a K = Jτm
; τpl , 1 K , and Jτm
K = 1≤j ≤n Jτm
K.
′ ; τp ′
′ ; τp j
j

Let Γ ′ ∈ branches([ Γ ]ni ).
′ , there exists j ∈ J1, nK such that there exists a proof Π ′′ of Γ ′ ⊢ [ M ]Γ ∼ [ N ]Γ : Jτ l ′′, 1 ; τ l ′′′, 1 K →
By Lemma B.5, using Π2,
2 i
2 i
2, Γ′
Γ′
p′
m′
j

j

[ c ′ ]iΓ .
In addition, [ P ]iΓ = [ if M 1 = M 2 then P⊤ else P⊥ ]iΓ = if [ M 1 ]iΓ = [ M 2 ]iΓ then [ P⊤ ]iΓ else [ P⊥ ]iΓ . Similarly, [ Q ]iΓ =
if [ N 1 ]iΓ = [ N 2 ]iΓ then [ Q ⊤ ]iΓ else [ Q ⊥ ]iΓ .
′′′
l ′, 1
l, 1
l ′′, 1
, τpl ′ , 1 .
For any j ∈ J1, nK, τm
, τm
′ ; and τp
j

j

′ , Π ′′ and rule PIfLR, we have
Therefore, using Π Γ′ , Π1,
Γ′
2, Γ′

Γ ′ ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C Γ′ (⊆ [ C ]ni ).
This holds for any Γ ′ ∈ branches([ Γ ]ni ).
Thus by Lemma B.33, there exists C ′ ⊆ [ C ]ni such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → C ′
which proves the claim in this case.
– if a is ∞ and a ′ is 1: This case is similar to the symmetric one.
– if a and a ′ both are ∞: This case is similar to the case where a is 1 and a ′ is ∞.

Theorem B.36 (Typing n sessions). For all Γ, P, Q and C, such that
Γ ⊢P ∼Q →C
then for all n ∈ N,

where [ Γ

]n

there exists C ′

is deﬁned as

Ð

⊆ ∪×1≤i ≤n [ C

1≤i ≤n

]ni

such that

[ Γ ]n ⊢ [ P ]1Γ | . . . | [ P ]nΓ ∼ [ Q ]1Γ | . . . | [ Q ]nΓ → C ′
[Γ

]ni .

Proof. Let us assume Γ, P, Q and C are such that
Γ ⊢ P ∼ Q → C.
Let n ∈ N.
Ð
Note that the union 1≤i ≤n [ Γ ]ni is well-deﬁned, as for i , j, dom([ Γ ]ni ) ∩ dom([ Γ ]nj ) ⊆ K ∪ N , and the types associated to keys and
nonces are the same in each [ Γ ]ni .
The property follows from Theorem B.35. Indeed, this theorem guarantees that for all i ∈ J1, nK, there exists Ci ⊆ [ C ]ni such that
[ Γ ]ni ⊢ [ P ]iΓ ∼ [ Q ]iΓ → Ci .

By construction, all variables in dom([ Γ ]ni ) are indexed with i, and as we mentioned earlier, for all i, j, [ Γ ]ni and [ Γ ]nj have the same
values on their common domain.
Ð
Hence we have [ Γ ]n = [ Γ ]ni ⊎ ( j,i ([ Γ ]nj ) ). Therefore, by Lemma B.10, we have for all i ∈ J1, nK
X

[ Γ ]n ⊢ [ P ]iΓ ∼ [ Q ]iΓ → Ci′

where
Ci′ = {(c, Γ ′ ∪ Γ ′′ )|(c, Γ ′ ) ∈ Ci ∧ Γ ′′ ∈ branches(

Ø

([ Γ ]nj ) )}

j,i

Thus, by applying rule PPar n − 1 times, we have

X

[ Γ ]n ⊢ [ P ]1Γ | . . . | [ P ]nΓ ∼ [ Q ]1Γ | . . . [ Q ]nΓ → ∪×1≤i ≤nCi′ .
It only remains to be proved that ∪×1≤i ≤n Ci′ ⊆ ∪×1≤i ≤n [ C ]ni . Since for all i ∈ J1, nK we have Ci ⊆ [ C ]ni , by Lemma B.11 we know
that ∪×1≤i ≤n Ci ⊆ ∪×1≤i ≤n [ C ]ni .
Hence it suﬃces to show that ∪×1≤i ≤n Ci′ ⊆ ∪×1≤i ≤n Ci .
Ð
Ð
Let (c, Γ ′ ) ∈ ∪×1≤i ≤nCi′. By deﬁnition there exist (c 1 , Γ1 ) ∈ C 1′ , . . . , (cn , Γn ) ∈ Cn′ such that c = 1≤i ≤n ci , Γ ′ = 1≤i ≤n Γi , and for all
i , j, Γi and Γj are compatible.
Ð
For all i, (ci , Γi ) ∈ Ci′. Thus by deﬁnition of Ci′ there exist Γi′ and Γi′′ such that (ci , Γi′ ) ∈ Ci , Γi′′ ∈ branches( j,i ([ Γ ]nj ) ), and Γi = Γi′ ∪Γi′′ .
X
Since for all i , j, Γi and Γj are compatible, we know that Γi′ and Γj′ also are, as well as Γi′ and Γj′′ .
Ð
Ð
Ð
Ð
Hence, Γ ′ = 1≤i ≤n Γi = 1≤i ≤n (Γi′ ∪ Γi′′ ) = ( 1≤i ≤n Γi′ ) ∪ ( 1≤i ≤n Γi′′ ).
Ð
Ð
′′
′
Moreover, ( 1≤i ≤n Γi ) = ( 1≤i ≤n Γi ). Indeed, they have the same domain, i.e. {xi | x ∈ dom(Γ) ∧ 1 ≤ i ≤ n}, and are compatible since
for all i , j, Γi′ and Γj′′ are compatible.
Ð
Thus Γ ′ = ( 1≤i ≤n Γi′ ), and since the Γi′ are all pairwise compatible, and for all i, (ci , Γi′ ) ∈ Ci , we have (c, Γ ′ ) ∈ ∪×1≤i ≤nCi .
This proves that ∪×1≤i ≤nCi′ ⊆ ∪×1≤i ≤n Ci , which concludes the proof.

This next theorem corresponds to Theorem 6.2:
Theorem B.37. Consider P, Q, P ′ ,Q ′ , C, C ′, such that P, Q and P ′ , Q ′ do not share any variable. Consider Γ, containing only keys and
nonces with types of the form τnl, 1 .
l, ∞
Assume that P and Q only bind nonces with inﬁnite nonce types, i.e. using new m : τm
for some label l; while P ′ and Q ′ only bind nonces
l, 1
with ﬁnite types, i.e. using new m : τm .
Let us abbreviate by new n the sequence of declarations of each nonce m ∈ dom(Γ). If
• Γ ⊢ P ∼ Q → C,
• Γ ⊢ P ′ ∼ Q ′ → C ′,
• C ′∪× (∪×1≤i ≤n [ C ]ni ) is consistent for all n,
then
new n. ((!P) | P ′ ) ≈t new n. ((!Q) | Q ′ ).
Proof. Note that since Γ only contains keys and nonces with ﬁnite types, for all i, [ P ]iΓ = [ P ]i∅ is just P where all variables and some
names have been α-renamed, and similarly for Q. Since P ′ , Q ′ only contain nonces with ﬁnite types, [ P ′ ]1Γ and [ Q ′ ]1Γ are P ′ , Q ′ where all
variables have been α-renamed.
By Theorem B.36, we know that for all i, n,
Ð

[ Γ ]n ⊢ [ P ]1Γ | . . . | [ P ]nΓ ∼ [ Q ]1Γ | . . . | [ Q ]nΓ → C ′′

where [ Γ ]n = 1≤i ≤n [ Γ ]ni , and C ′′ ⊆ ∪×1≤i ≤n [ C ]ni .
By Theorem B.35, there also exists C ′′′ ⊆ [ C ′ ]n1 , such that
 Γ 
Γ
[ Γ ]n1 ⊢ P ′ 1 ∼ Q ′ 1 → C ′′′ .
Therefore, by Lemma B.10, we have
 Γ 
Γ
[ Γ ]n ⊢ P ′ 1 ∼ Q ′ 1 → C ′′′′
Ð
where C ′′′′ is C ′′′ where all the environments have been extended with 1≤i ≤n ([ Γ ]ni ) X (note that this environment still only contains
nonces and keys).
Therefore, by rules PPar and PNew,
 Γ

Γ
Γ ′ ⊢ new n. ([ P ]1Γ | . . . | [ P ]nΓ ) | P ′ 1 ∼ new n. ([ Q ]1Γ | . . . | [ Q ]nΓ ) | Q ′ 1 → C ′′ ∪×C ′′′′
where Γ ′ is the restriction of [ Γ ]n to keys.
If [ C ′ ]n1 ∪× (∪×1≤i ≤n [ C ]ni ) is consistent, similarly to the reasoning in the proof of Theorem B.36, C ′′ ∪×C ′′′′ also is.
Then, by Theorem B.28,
 Γ

Γ
new n. ([ P ]1Γ | . . . | [ P ]nΓ ) | P ′ 1 ≈t new n. ([ Q ]1Γ | . . . | [ Q ]nΓ ) | Q ′ 1

which implies (since [ P ′ ]1Γ is just a renaming of the variables in P ′ ) that

new n. ([ P ]1Γ | . . . | [ P ]nΓ ) | P ′ ≈t new n. ([ Q ]1Γ | . . . | [ Q ]nΓ ) | Q ′

Since [ P ]iΓ and [ Q ]iΓ are just α-renamings of P, Q, this implies that for all n,
new n. (P1 | . . . | Pn ) | P ′ ≈t new n. (Q 1 | . . . | Qn ) | Q ′
where P1 = · · · = Pn = P, and Q 1 = · · · = Qn = Q. Therefore
new n. ((!P) | P ′ ) ≈t new n. ((!Q) | Q ′ ).


B.3

Checking consistency

In this subsection, we ﬁrst recall the check_const procedure from Section 6.3, in more detail, and prove its correctness in the non-replicated
case.

For a constraint c and an environment Γ, let
step1 Γ (c) := (JcKσ F , σ ′ , Γ ′ ),
F

where
′

σ F , σ F′ are the substitutions deﬁned by
• dom(σ F ) = dom(σ F′ ) = F

l, 1
F = {x ∈ dom(Γ) | ∃m, n, l, l ′ . Γ(x) = Jτm
; τnl , 1 K},

′

l, 1
• ∀x ∈ F . ∀m, n, l, l ′ .Jτm
; τnl , 1 K ⇒ σ F (x) = m ∧ σ F′ (x) = n,

and Γ ′ is the environment obtained by extending the restriction of Γ to dom(Γ)\F with Γ ′ (n) = τnl, 1 for all nonce n such that τnl, 1 occurs in
Γ. This is well deﬁned, since by assumption on the well-formedness of the processes and by deﬁnition of the processes, a name n is always
associated with the same label.

Let −→Γ be the reduction relation deﬁned on couples of sets of constraints by (all variables are universally quantiﬁed)
({hM, N i ∼ hM ′, N ′ i} ∪ c, c ′)

−→Γ

({M ∼ M ′, N ∼ N ′ } ∪ c, c ′ )

({enc(M, k) ∼ enc(M ′, k)} ∪ c, c ′)

−→Γ

({M ∼ M ′ } ∪ c, c ′ )
if Γ(k) = keyLL (T ) for some T

({aenc(M, pk(k)) ∼ aenc(M ′, pk(k))} ∪ c, c ′)

−→Γ

({M ∼ M ′ } ∪ c, c ′ )
if Γ(k) = keyLL (T ) for some T

({sign(M, k) ∼ sign(M ′, k)} ∪ c, c ′)

−→Γ

({M ∼ M ′ } ∪ c, c ′ )
if Γ(k) = keyLL (T ) for some T

({sign(M, k) ∼ sign(M ′, k)} ∪ c, c ′)

−→Γ

({M ∼ M ′ } ∪ c, {sign(M, k) ∼ sign(M ′, k)} ∪ c ′ )
if Γ(k) = keyHH (T ) for some T

Let then step2 Γ (c) = c 1 ∪ c 2 where (c 1 , c 2 ) is the normal form of (c, ∅) for −→Γ . This deﬁnition is equivalent to the one described in
Section 6.3, but more practical for the proofs.

We deﬁne the condition step3 Γ (c) as: check that c only contains elements of the form M ∼ N where M and N are both
a key k ∈ K such that ∃T .Γ(k) = keyLL (T );
nonces m, n ∈ N such that Γ(n) = τnLL, a ∧ Γ(m) = τnLL, a ,
or public keys, veriﬁcation keys, or constants;
or enc(M ′, k), enc(N ′, k) such that ∃T .Γ(k) = keyLL (T );
or either hashes h(M ′ ), h(N ′ ) or encryptions aenc(M ′, pk(k)), aenc(N ′, pk(k)) with a honest key k, i.e. such that ∃T .Γ(k) = keyHH (T );
such that M ′ and N ′ contain directly under pairs a nonce n such that Γ(n) = τnHH, a or a secret key k such that ∃T .Γ(k) = keyHH (T );
• or signatures sign(M ′, k), sign(N ′, k) with honest keys, such that ∃T .Γ(k) = keyHH (T );

•
•
•
•
•

step3 Γ (c) returns true if this check succeeds and false otherwise.
We then proceed to step4. We deﬁne condition step4 Γ (c) as follows. We consider all M ∼ M ′ ∈ c and N ∼ N ′ ∈ c, such that M, N are
uniﬁable with a most general uniﬁer µ, and such that
′

l, ∞
∀x ∈ dom(µ). ∀l, l ′, m, n. (Γ(x) = Jτm
; τpl , ∞ K) ⇒ (xµ ∈ X ∨ ∃i. xµ = m i ).
′

l, ∞
We then deﬁne the substitution θ, over all variables x ∈ dom(µ) such that Γ(x) = Jτm
; τpl , ∞ K by

∀x ∈ dom(µ). ∀l, l ′,m, p, i.

′

l, ∞
(Γ(x) = Jτm
; τpl , ∞ K ∧ µ(x) = m i ) ⇒ θ(x) = pi

and θ(x) = x otherwise.
Let then α be the restriction of µ to {x ∈ dom(µ) | Γ(x) = LL ∧ µ(x) ∈ N }.
We then check that M ′αθ = N ′αθ.

Similarly, we check that the symmetric condition, when M ′ and N ′ are uniﬁable, holds for all M ∼ M ′ ∈ c and N ∼ N ′ ∈ c.
If all these checks succeed, step4 Γ (c) returns true.
Finally, check_const(C) is computed by considering all (c, Γ) ∈ C. We let (c, Γ) = step1 Γ (c), and c̃ = step2Γ (c). We then check that
step3 Γ (c̃) = true and step4 Γ (c̃) = true. If this check succeeds for all (c, Γ) ∈ C, we say that check_const(C) = true.

Note that we only consider constraints obtained by typing, and therefore such that there exists cϕ such that Γ ⊢ ϕ l(c) ∼ ϕ r (c) : LL → cϕ .
Indeed, it is clear by induction on the typing rules for terms that:
∀Γ, M, N ,T , c.

Γ ⊢ M ∼ N : T → c =⇒ (∀u ∼ v ∈ c.

∃c ′ .

Γ ⊢ u ∼ v : LL → c ′ ).

From this result, and using Lemmas B.3 and B.12, it follows clearly by induction on the typing rules for processes that
∀Γ, P, Q, C.

Γ ⊢ P ∼ Q → C =⇒ (∀(c, Γ ′ ) ∈ C.

∀u ∼ v ∈ c.

∃c ′ .

Γ ′ ⊢ u ∼ v : LL → c ′ ).

Let us now prove that the procedure is correct for constraints without inﬁnite nonce types, i.e. constraint sets C such that
′

l, ∞
∀(c, Γ) ∈ C. ∀l, l ′,m, n. Γ(x) , Jτm
; τnl , ∞ K.

We ﬁx such a constraint set C (obtained by typing).
Let (c, Γ) ∈ C. Let (c, Γ) = step1 Γ (c), and c̃ = step2 Γ (c). Let us assume that step3 Γ (c̃) = true and step4 Γ (c̃) = true.
Lemma B.38. If c is consistent in Γ, then c is consistent in Γ.
Proof. Let c ′ be a set of constraints and Γ ′ be a typing environment such that c ′ ⊆ c, Γ ′ ⊆ Γ, Γ ′ N, K = ΓN, K and vars(c ′ ) ⊆ dom(Γ ′ ).
Let σ , σ ′ be two substitutions such that Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c σ (for some set of constraints c σ ).
Γ ∪ϕ (Jc ′ K
′
Γ
To prove the claim, we need to show that the frames new EΓ .(ϕ LL
l
σ , σ ′ )) and new EΓ .(ϕ LL ∪ϕ r (Jc Kσ , σ ′ )) are statically equivalent.
Let D denote dom(Γ ′ X )(= dom(σ ) = dom(σ ′ )).
′
l, 1
For all x ∈ F ∩ D, by deﬁnition of F , there exist m, n, l, l ′ such that Γ(x) = Jτm
; τnl , 1 K. Thus, by well-typedness of σ , σ ′ , there exists c x
′
l, 1
such that Γ ⊢ σ (x) ∼ σ ′ (x) : Jτm
; τnl , 1 K → c x . Hence, by Lemma B.14, since σ , σ ′ are ground, we have σ (x) = m and σ ′ (x) = n. Therefore,
σ |D∩F = σ F |D and σ ′ |D∩F = σ F′ |D .
Let c ′′ be the set Jc ′ Kσ |D∩F , σ ′ |D∩F . By Lemma B.11, we have Jc ′ Kσ , σ ′ = Jc ′′ Kσ |D\F , σ ′ |D\F . We also have c ′′ = Jc ′ Kσ F |D , σ ′ |D , which is
F
equal to Jc ′ Kσ F , σ ′ since vars(c ′ ) ⊆ D. Hence c ′′ ⊆ c.
F

Let Γ ′′ = Γ ′ |dom(Γ′ )\F . We have Γ ′′ ⊆ Γ.
Moreover, since Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c σ , it is clear from the deﬁnition of well-typedness for substitutions that we also have
′′
Γ N, K ⊢ σ |D\F ∼ σ ′ |D\F : Γ ′′ X → c σ′ for some c σ′ . Finally, vars(c ′′ ) ⊆ vars(c ′ )\F by deﬁnition of instantiation, thus vars(c ′′ ) ⊆ dom(Γ ′′ ).
We have established that c ′′ ⊆ c, Γ ′′ ⊆ Γ, vars(c ′′ ) ⊆ dom(Γ ′′ ), and Γ ′′ N, K ⊢ σ |D\F ∼ σ ′ |D\F : Γ ′′ X → c σ′ . Therefore, by deﬁnition of

′′
Γ ∪ ϕ (Jc ′′ K
Γ
the consistency of c in Γ, the frames new EΓ .(ϕ LL
l
σ |D\F , σ ′ |D\F )) and new EΓ .(ϕ LL ∪ ϕ r (Jc Kσ |D\F , σ ′ |D\F )) are statically equivalent.

Γ ⊆ ϕ Γ , that is to say that new E .(ϕ Γ ∪ ϕ (Jc ′ K
Γ
′
Since ϕ LL
Γ
l
σ , σ ′ )) and new EΓ .(ϕ LL ∪ ϕ r (Jc Kσ , σ ′ )) are statically equivalent. This proves
LL
LL
the consistency of c in Γ.


Lemma B.39. If (c 1 , c 2 )−→Γ ∗ (c 1′ , c 2′ ) then for all x ∈ dom(ϕ l(c 1′ ∪ c 2′ )) there exists a recipe R such that
Γ ∪ ϕ (c ∪ c ))
• vars(R) ⊆ dom(ϕ LL
2
l 1
′
′
Γ ∪ ϕ (c ∪ c )) ↓
• ϕ l(c 1 ∪ c 2 )(x) = R(ϕ LL
2
l 1
Γ ∪ ϕ (c ∪ c )) ↓.
• ϕ r (c 1′ ∪ c 2′ )(x) = R(ϕ LL
2
r 1
Conversely, if (c 1 , c 2 )−→Γ ∗ (c 1′ , c 2′ ) then for all x ∈ dom(ϕ l(c 1 ∪ c 2 )) there exists a recipe R without destructors, i.e. in which dec, adec,
checksign, π1 , π2 do not appear, such that
Γ ∪ ϕ (c ′ ∪ c ′ ))
• vars(R) ⊆ dom(ϕ LL
l 1
2
Γ ∪ ϕ (c ′ ∪ c ′ ))
• ϕ l(c 1 ∪ c 2 )(x) = R(ϕ LL
l 1
2
Γ ∪ ϕ (c ′ ∪ c ′ )).
• ϕ r (c 1 ∪ c 2 )(x) = R(ϕ LL
r 1
2

Proof. For both directions, it suﬃces to prove that the claim holds for all c 1 , c 2 , c 1′ , c 2′ such that (c 1 , c 2 )−→Γ (c 1′ , c 2′ ). Indeed, in that case
we prove the result for −→Γ ∗ by composing all the recipes. The proof for one reduction step is clear by examining the cases for the reduction
−→Γ .

Lemma B.40. If c̃ is consistent in Γ, then c is consistent in Γ.
Proof. This follows directly from Lemma B.39.
Let c ′ be a set of constraints and Γ ′ be a typing environment such that c ′ ⊆ c, Γ ′ ⊆ Γ, Γ ′ N, K = Γ N, K and vars(c ′ ) ⊆ dom(Γ ′ ). Let σ , σ ′
be two substitutions such that Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c σ (for some set of constraints c σ ).
′
Γ ∪ϕ (Jc ′ K
Γ
To prove the claim, we need to show that the frames new EΓ .(ϕ LL
l
σ , σ ′ )) and new EΓ .(ϕ LL ∪ϕ r (Jc Kσ , σ ′ )) are statically equivalent.
Γ ∪ ϕ (Jc̃K
Γ
Since c̃ is consistent in Γ, we know that the frames new EΓ .(ϕ LL
l
σ , σ ′ )) and new EΓ .(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) are statically equivalent.
′
Γ ∪ ϕ (Jc ′ K
Γ
By Lemma B.39, the frames new EΓ .(ϕ LL
l
σ , σ ′ )) and new EΓ .(ϕ LL ∪ ϕ r (Jc Kσ , σ ′ )) can be written as a recipe on the frames

Γ ∪ ϕ (Jc̃K
Γ
new EΓ .(ϕ LL
l
σ , σ ′ )) and new EΓ .(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )).
Therefore, they are also statically equivalent, which proves the claim.



Γ ∪ ϕ (c) ∼ ϕ Γ ∪ ϕ (c) : LL → c .
Lemma B.41. There exists cϕ such that Γ ⊢ ϕ LL
r
l
ϕ
LL

Proof. As explained previously, there exists cϕ′ such that Γ ⊢ ϕ l(c) ∼ ϕ r (c) : LL → cϕ′ .
′

′

Moreover, we have by deﬁnition Γ = ΓF ⊎ Γ , where F is deﬁned as in step1 and ΓF is the restriction of Γ to F , and for some Γ ⊆ Γ.
In addition ΓF N, K ⊢ σ F ∼ σ F′ : ΓF X → c ′ for some c ′ . By deﬁnition of F , and since the reﬁnement types in Γ only contain ground terms
by assumption, we also know that Γ does not contain reﬁnement types. Hence, by Lemma B.22, and Lemma B.10, there exists cϕ such that
Γ ⊢ ϕ l(c)σ F ∼ ϕ r (c)σ F′ : LL → cϕ . Since c = JcKσ F , σ ′ , this proves that Γ ⊢ ϕ l(c) ∼ ϕ r (c) : LL → cϕ . Besides, it is clear from the deﬁnition
F

Γ and rules TCstFN, TNonceL, TKey, TPubKey, TVKey that Γ ⊢ ϕ Γ ∼ ϕ Γ : LL → ∅.
of ϕ LL
LL
LL
These two results prove the lemma.

Lemma B.42. There exists cϕ such that Γ ⊢

Γ
ϕ LL

∪ ϕ l(c̃)

Γ
∼ ϕ LL



∪ ϕ r (c̃) : LL → cϕ .

Γ ∪ ϕ (c) ∼ ϕ Γ ∪ ϕ (c) : LL → c ′ .
Proof. By Lemma B.41, there exists cϕ′ such that Γ ⊢ ϕ LL
r
l
LL
ϕ
Moreover, by deﬁnition, there exist c 1 , c 2 such that (c, ∅)−→Γ ∗ (c 1 , c 2 ) and c̃ = c 1 ∪ c 2 . Hence, we know by Lemma B.39 that for all
Γ ∪ ϕ (c)) ↓ and ϕ (c̃)(x) = R(ϕ Γ ∪ ϕ (c)) ↓.
x ∈ dom(ϕ l(c̃))(= dom(ϕ r (c̃))) there exists a recipe R such that names(R) = ∅, ϕ l(c̃)(x) = R(ϕ LL
r
r
l
LL
Γ and rules TCstFN,
Thus, by Lemma B.21, there exists cϕ such that Γ ⊢ ϕ l(c̃) ∼ ϕ r (c̃) : LL → cϕ . Besides, it is clear from the deﬁnition of ϕ LL
Γ ∼ ϕ Γ : LL → ∅.
TNonceL, TKey, TPubKey, TVKey that Γ ⊢ ϕ LL
LL
These two results prove the lemma.



We now assume that c̃ satisﬁes the condition step3 Γ (c̃).
Note that we write −→Γ for −→Γ as these relations are equal.
Lemma B.43. If (c, ∅)−→Γ ∗ (c 1 , c 2 ) and sign(M, k) ∼ sign(N , k ′) ∈ c 2 then there exists a recipe R without destructors, i.e. in which dec,
adec, checksign, π1 , π2 do not appear, such that
Γ ∪ ϕ (c ∪ c ))
• vars(R) ⊆ dom(ϕ LL
2
l 1
Γ
• M = R(ϕ LL ∪ ϕ l(c 1 ∪ c 2 ))
Γ ∪ ϕ (c ∪ c )).
• N = R(ϕ LL
r 1
2

Proof. We prove this property by induction on the length of the reduction. It trivially holds if no reduction step is performed since in
that case c 2 = ∅. Otherwise there exist c 1′ , c 2′ such that (c, ∅)−→Γ ∗ (c 1′ , c 2′ )−→Γ (c 1 , c 2 ).
If (c 1′ , c 2′ )−→Γ (c 1 , c 2 ) is any case except the honest signature case, we have c 2 = c 2′ . Thus if sign(M, k) ∼ sign(N , k ′) ∈ c 2 , then by the
induction hypothesis there exists R ′ without destructors such that
Γ ∪ ϕ (c ′ ∪ c ′ ))
• vars(R ′ ) ⊆ dom(ϕ LL
l 1
2
Γ ∪ ϕ (c ′ ∪ c ′ ))
• M = R ′ (ϕ LL
l 1
2
Γ ∪ ϕ (c ′ ∪ c ′ )).
• N = R ′ (ϕ LL
r 1
2
We then prove the claim by applying (the second part of) Lemma B.39 and composing the recipes.
If (c 1′ , c 2′ )−→Γ (c 1 , c 2 ) corresponds to the honest signature case, we have c 1′ = c 1′′ ∪ {sign(M ′, k ′′ ) ∼ sign(N ′, k ′′ )}, c 1 = c 1′′ ∪ {M ′ ∼ N ′ },
and c 2 = c 2′ ∪ {sign(M ′, k ′′ ) ∼ sign(N ′, k ′′ )} for some c 1′′ , M ′ , N ′, k ′′ , T such that Γ(k ′ ) = keyHH (T ). If (sign(M ′, k ′′ ), sign(N ′, k ′′ )) ,
(sign(M, k), sign(N , k ′)), then the same proof as in the previous case shows the claim. Otherwise, M ∼ N ∈ c 1 , and therefore the claim
trivially holds.


Lemma B.44. If sign(M, k) ∼ sign(N , k ′) ∈ c̃ then there exists a recipe R without destructors, i.e. in which dec, adec, checksign, π1 , π2
do not appear, such that
• names(R) = ∅,
Γ ∪ ϕ (c̃))
• vars(R) ⊆ dom(ϕ LL
l
Γ ∪ ϕ (c̃))
• M = R(ϕ LL
l
Γ ∪ ϕ (c̃)).
• N = R(ϕ LL
r

Proof. This property directly follows from Lemma B.43, applied to (c, ∅)−→Γ ∗ (c 1 , c 2 ) such that c̃ = c 1 ∪ c 2 . Indeed, since (c 1 , c 2 ) is a
normal form for −→Γ , if sign(M, k) ∼ sign(N , k ′ ) ∈ c̃ = c 1 ∪ c 2 , then sign(M, k) ∼ sign(N , k ′ ) ∈ c 2 , as if it was an element of c 1 then
another reduction step would be possible.

R′

Γ ∪ ϕ (c̃)), and R(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥ or R(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥, there exists a recipe
Lemma B.45. For all recipe R such that vars(R) ⊆ dom(ϕ LL
r
l
l
LL
LL
without destructors, i.e. in which dec, adec, checksign, π1 , π2 , do not appear, such that
Γ ∪ ϕ (c̃)),
• vars(R ′ ) ⊆ dom(ϕ LL
l
Γ ∪ ϕ (c̃)) ↓= R ′ (ϕ Γ ∪ ϕ (c̃)),
• R(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= R ′ (ϕ Γ ∪ ϕ (c̃)).
• R(ϕ LL
r
r
LL

Proof. Let us ﬁrst note that
Γ
Γ
R(ϕ LL
∪ ϕ l(c̃)) ↓, ⊥ or R(ϕ LL
∪ ϕ r (c̃)) ↓, ⊥

is equivalent to
Γ
Γ
R(ϕ LL
∪ ϕ l(c̃)) ↓, ⊥ and R(ϕ LL
∪ ϕ r (c̃)) ↓, ⊥.

This follows from Lemmas B.42 and B.21.
We prove the property by induction on R.
• If R = n ∈ N or R = x ∈ AX or R = a ∈ C ∪ F N then the claim holds with R ′ = R.
• If the head symbol of R is a constructor,i.e. if there exist R 1 , R 2 such that R = pk(R 1 ) or R = vk(R 1 ) or R = enc(R 1 , R 2 ) or R =
aenc(R 1 , R 2 ) or R = sign(R 1 , R 2 ) or R = hR 1 , R 2 i or R = h(R 1 ), we may apply the induction hypothesis to R 1 (and R 2 when it is
present). All these case are similar, we write the proof generically for R = f (R 1 , R 2 ). By the induction hypothesis, there exist R 1′ , R 2′
such that
Γ ∪ ϕ (c̃)),
– vars(R 1′ ) ∪ vars(R 2′ ) ⊆ dom(ϕ LL
l
Γ ∪ ϕ (c̃)) ↓= R ′ (ϕ Γ ∪ ϕ (c̃)),
– for all i ∈ {1, 2}, Ri (ϕ LL
l
l
i LL
Γ ∪ ϕ (c̃)) ↓= R ′ (ϕ Γ ∪ ϕ (c̃)).
– for all i ∈ {1, 2}, Ri (ϕ LL
r
r
i LL
Γ ∪ϕ (c̃)) ↓= f (R (ϕ Γ ∪ϕ (c̃)) ↓
Let R ′ be f (R 1′ , R 2′ ). The ﬁrst two points imply that R ′ satisﬁes the conditions on variables. Since R(ϕ LL
1 LL
l
l
Γ ∪ ϕ (c̃)) ↓), the third point implies that R(ϕ Γ ∪ ϕ (c̃)) ↓= R ′ (ϕ Γ ∪ ϕ (c̃)). Similarly, R(ϕ Γ ∪ ϕ (c̃)) ↓= R ′ (ϕ Γ ∪ ϕ (c̃)), and
, R 2 (ϕ LL
r
r
l
l
l
LL
LL
LL
LL
the claim holds.
Γ ∪ ϕ (c̃)) ↓, ⊥, we have K(ϕ Γ ∪ ϕ (c̃)) ↓= k for some k ∈ K, and S(ϕ Γ ∪
• If R = dec(S, K) for some recipes S, K, then since R(ϕ LL
l
l
LL
LL
Γ ∪ ϕ (c̃)) ↓.
ϕ l(c̃)) ↓= enc(M, k), where M = R(ϕ LL
l
Γ ∪ ϕ (c̃)) ↓= k ′ and S(ϕ Γ ∪ ϕ (c̃)) ↓= enc(N , k ′ ), where N = R(ϕ Γ ∪ ϕ (c̃)) ↓.
Similarly, there exists k ′ ∈ K such that K(ϕ LL
r
r
r
LL
LL

Γ ∪ ϕ (c̃) ∼ ϕ Γ ∪ ϕ (c̃) : LL → c ′ . Thus by Lemma B.21, there exists c ′′
In addition, by Lemma B.42, there exists c ′ such that Γ ⊢ ϕ LL
r
l
LL
Γ
Γ
′′
such that Γ ⊢ K(ϕ LL ∪ ϕ l(c̃)) ↓∼ K(ϕ LL ∪ ϕ r (c̃)) ↓: LL → c , which is to say Γ ⊢ k ∼ k ′ : LL → c ′′ . Hence by Lemma B.18, k = k ′ and
Γ(k) = keyLL (T ) for some type T .
Γ ∪ ϕ (c̃)) ↓= enc(M, k) , ⊥, by the induction hypothesis, there exists S ′ such that vars(S ′ ) ⊆ vars(S), S ′ (ϕ Γ ∪ ϕ (c̃)) =
Since S(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= enc(M, k), and S ′ (ϕ Γ ∪ ϕ (c̃)) = S(ϕ Γ ∪ ϕ (c̃)) ↓= enc(N , k).
S(ϕ LL
r
r
l
LL
LL
It is then clear that either S ′ = x for some variable x ∈ AX, or S ′ = enc(S ′′, K ′) for some S ′′ , K ′. The ﬁrst case is impossible, since
we have already shown that Γ(k) = keyLL (T ), and since by step3Γ (c̃), c̃ only contains messages encrypted with keys k ′′ such that
Γ(k ′′ ) = keyHH (T ′) for some T ′ .
Γ ∪ ϕ (c̃)) = enc(M, k), we have S ′′ (ϕ Γ ∪ ϕ (c̃)) = M. Hence
Hence there exist S ′′ , K ′ such that S ′ = enc(S ′′, K ′). Since S ′ (ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= M = S ′′ (ϕ Γ ∪ ϕ (c̃)), and similarly for ϕ (c̃). Moreover, S ′′ being a subterm of S ′ it also satisﬁes the conditions
R(ϕ LL
r
l
l
LL
on the domains, and thus the property holds with R ′ = S ′′ .
• If R = adec(S, K) for some recipes S, K: this case is similar to the symmetric case.
Γ ∪ ϕ (c̃)) ↓, ⊥, we have K(ϕ Γ ∪ ϕ (c̃)) ↓= vk(k) for some k ∈ K, and
• If R = checksign(S, K) for some recipes S, K: then since R(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= sign(M, k), where M = R(ϕ Γ ∪ ϕ (c̃)) ↓.
S(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= vk(k ′ ) and S(ϕ Γ ∪ ϕ (c̃)) ↓= sign(N , k ′ ), where N = R(ϕ Γ ∪ ϕ (c̃)) ↓.
Similarly, there exists k ′ ∈ K such that K(ϕ LL
r
r
r
LL
LL
Γ ∪ ϕ (c̃)) ↓= sign(M, k) , ⊥, by the induction hypothesis, there exists S ′ such that vars(S ′ ) ⊆ vars(S), S ′ (ϕ Γ ∪ ϕ (c̃)) =
Since S(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= sign(M, k), and S ′ (ϕ Γ ∪ ϕ (c̃)) = S(ϕ Γ ∪ ϕ (c̃)) ↓= sign(N , k).
S(ϕ LL
r
r
l
LL
LL
Γ ∪ ϕ (c̃)) = sign(M, k), it is clear from the deﬁnition of ↓ that either S ′ = x for some x ∈ AX, or S ′ = sign(S ′′ , K ′) for
Since S ′ (ϕ LL
l
′′
some S , K ′.
In the ﬁrst case, we therefore have sign(M, k) ∼ sign(N , k ′ ) ∈ c̃, and Lemma B.44 directly proves the claim.
Γ ∪ ϕ (c̃)) = sign(M, k), we have S ′′ (ϕ Γ ∪ ϕ (c̃)) = M.
In the second case, there exist S ′′ , K ′ such that S ′ = sign(S ′′, K ′). Since S ′(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= M = S ′′ (ϕ Γ ∪ ϕ (c̃)), and similarly for ϕ (c̃). Moreover, S ′′ being a subterm of S ′ it also satisﬁes the
Hence R(ϕ LL
r
l
l
LL
conditions on the domains, and thus the property holds with R ′ = S ′′ .
Γ ∪ ϕ (c̃)) ↓, ⊥, we have S(ϕ Γ ∪ ϕ (c̃)) ↓= hM , M i, where M = R(ϕ Γ ∪ ϕ (c̃)) ↓,
• If R = π1 (S) for some recipe S then since R(ϕ LL
1
2
1
l
l
l
LL
LL
and M 2 is a message.
Γ ∪ ϕ (c̃)) ↓= hN , N i, where N = R(ϕ Γ ∪ ϕ (c̃)) ↓, and N is a message.
Similarly, S(ϕ LL
1 2
1
2
r
r
LL
Γ ∪ ϕ (c̃)) ↓= hM , M i , ⊥, by the induction hypothesis, there exists S ′ such that vars(S ′ ) ⊆ vars(S), S ′ (ϕ Γ ∪ ϕ (c̃)) =
Since S(ϕ LL
1
2
l
l
LL
Γ
Γ ∪ ϕ (c̃)) = S(ϕ Γ ∪ ϕ (c̃)) ↓= hN , ki.
′
S(ϕ LL ∪ ϕ l(c̃)) ↓= hM, ki, and S (ϕ LL
r
r
LL
Γ ∪ ϕ (c̃)) = hM , M i, it is clear from the deﬁnition of ↓ that either S ′ = x for some x ∈ AX, or S ′ = hS , S i for some S ,
Since S ′(ϕ LL
1
2
1 2
1
l
S2.
The ﬁrst case is impossible, since by step3 Γ (c̃), c̃ does not contain pairs.
Γ ∪ ϕ (c̃)) = hM , M i, we have S (ϕ Γ ∪ ϕ (c̃)) = M . Hence
In the second case, there exist S 1 , S 2 such that S ′ = hS 1 , S 2 i. Since S ′ (ϕ LL
1
2
1 LL
1
l
l
Γ
Γ
R(ϕ LL ∪ ϕ l(c̃)) ↓= M 1 = S 1 (ϕ LL ∪ ϕ l(c̃)), and similarly for ϕ r (c̃). Moreover, S 1 being a subterm of S ′ it also satisﬁes the conditions
on the domains, and thus the property holds with R ′ = S 1 .
• If R = π2 (S) for some S: this case is similar to the π1 case.


Lemma B.46. For all term t and substitution σ containing only messages, if t ↓, ⊥, then (tσ ) ↓= (t ↓)σ .
Proof. This property is easily proved by induction on t. In the base case where t is a variable x, by deﬁnition of ↓, since σ (x) is a
messages, σ (x) ↓= σ (x) and the claim holds. In the other base cases where t is a name, key or constant the claim trivially holds. We prove
the case where t starts with a constructor other than enc, aenc, sign generically for t = f (t 1 , t 2 ). We then have t 1σ ↓, ⊥ and t 2σ ↓, ⊥,
and tσ ↓= f (t 1σ ↓, t 2 σ ↓), which, by the induction hypothesis, is equal to f (t 1 ↓ σ, t 2 ↓ σ ), i.e. to f (t 1 , t 2 ) ↓ σ . The case where f is enc,
aenc or sign is similar, but we in addition know that t 2 ↓ is a key.
Finally if t starts with a destructor, t = d(t 1, t 2 ), we know that t 1 ↓ starts with the corresponding constructor f : t 1 ↓= f (t 3 , t 4 ). In the
case of encryptions and signatures we know in addition that t 4 ↓ and t 2 ↓ are the same key (resp. public key/veriﬁcation key). We then have
t ↓= t 3 ↓, and tσ ↓= t 3 σ ↓ (or t 4 in the case of the second projection π2 ()). Hence by the induction hypothesis, tσ ↓= t 3 ↓ σ = t ↓ σ and the
claim holds.


Γ ∪ ϕ (c̃)), if R(ϕ Γ ∪ ϕ (Jc̃K
Γ
Lemma B.47. For all σ , σ ′ , for all recipe R such that vars(R) ⊆ dom(ϕ LL
l
l
σ , σ ′ )) ↓, ⊥ then R(ϕ LL ∪ ϕ l(c̃)) ↓, ⊥;
LL
Γ ∪ ϕ (Jc̃K
Γ
and similarly if R(ϕ LL
r
σ , σ ′ )) ↓, ⊥ then R(ϕ LL ∪ ϕ r (c̃)) ↓, ⊥.

Proof. We prove the property for ϕ l(c̃), as the proof for ϕ r (c̃) is similar.
We prove this by induction on R.
Γ ∪ ϕ (c̃)) ↓, ⊥ is trivial.
• if R = n ∈ N or R = x ∈ AX or R = a ∈ C ∪ F N : then R(ϕ LL
l
• If the head symbol of R is h·, ·i, h: all these cases are similar, we detail here the pair case. We have R = hR 1 , R 2 i. By assumption, we
Γ ∪ ϕ (Jc̃K
Γ
Γ
have R 1 (ϕ LL
l
σ , σ ′ )) ↓, ⊥ and R 2 (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )) ↓, ⊥. By the induction hypothesis, we thus have R 1 (ϕ LL ∪ ϕ l(c̃)) ↓, ⊥
Γ ∪ ϕ (c̃)) ↓, ⊥, and therefore R(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥.
and R 2 (ϕ LL
l
l
LL
• if the head symbol of R is enc, aenc, sign, pk, vk: all these cases are similar, we detail the proof for the asymmetric encryption case.
Γ ∪ ϕ (Jc̃K
Γ
Γ
We have R = aenc(S, K) for some recipes S, K. Since R(ϕ LL
r
σ , σ ′ )) ↓, ⊥, we have S(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓, ⊥, and K(ϕ LL ∪
ϕ r (Jc̃Kσ , σ ′ )) ↓= pk(k) for some k ∈ K.
Γ ∪ϕ (c̃)) ↓, ⊥ and K(ϕ Γ ∪ϕ (c̃)) ↓, ⊥. Hence, by Lemma B.45, there exists a recipe
By the induction hypothesis, we thus have S(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= K ′ (ϕ Γ ∪ ϕ (c̃)). Hence, using Lemma B.46, we have
K ′ without destructors, such that K(ϕ LL
l
l
LL
Γ
Γ
Γ
Γ
∪ ϕ r (Jc̃Kσ , σ ′ )) ↓= K((ϕ LL
∪ ϕ r (c̃))σ ) ↓= (K(ϕ LL
∪ ϕ l(c̃)) ↓)σ = K ′(ϕ LL
∪ ϕ l(c̃))σ
pk(k) = K(ϕ LL
Γ ∪ ϕ (c̃))σ = pk(k), there exists a variable x such that
Since K ′(ϕ LL
l
Γ ∪ ϕ (c̃))(x) = pk(k). If x ∈ dom(ϕ (c̃)),
– either K ′ = x, and then since ϕ l(c̃) does not contain variables by step3 Γ (c̃), we have (ϕ LL
l
l
since by Lemma B.42, there exists c x such that Γ ⊢ ϕ l(c̃)(x) ∼ ϕ r (c̃)(x) : LL → c x , we know by Lemma B.18 that ϕ r (c̃)(x) = pk(k).
Γ ∪ ϕ (c̃))(x) = k. If x ∈ dom(ϕ (c̃)), since
– or K ′ = pk(x), and then since ϕ l(c̃) does not contain variables by step3Γ (c̃), we have (ϕ LL
l
l
by Lemma B.42, there exists c x such that Γ ⊢ ϕ l(c̃)(x) ∼ ϕ r (c̃)(x) : LL → c x , we know by Lemma B.18 that ϕ r (c̃)(x) = k.
Γ ∪ ϕ (c̃))σ = K ′ (ϕ Γ ∪ ϕ (c̃)), and therefore
In any case K ′(ϕ LL
l
l
LL
Γ
Γ
K(ϕ LL
∪ ϕ r (c̃)) ↓= K ′(ϕ LL
∪ ϕ l(c̃)) = pk(k)
Γ ∪ ϕ (c̃)) ↓, ⊥, implies that R(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥.
which, together with the fact that S(ϕ LL
l
l
LL
• if the head symbol of R is dec, adec, checksign: all these cases are similar, we detail the proof for the signature veriﬁcation case. We
Γ ∪ ϕ (Jc̃K
Γ
have R = checksign(S, K) for some recipes S, K. Since R(ϕ LL
r
σ , σ ′ )) ↓, ⊥, we know that S(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓= sign(M, k)
Γ ∪ ϕ (Jc̃K
for some message M and some k ∈ K, and K(ϕ LL
r
σ , σ ′ )) ↓= vk(k).
Γ ∪ ϕ (c̃)) ↓, ⊥ and K(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥. Hence, by Lemma B.45, there exist recipes
By the induction hypothesis, we thus have S(ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= S ′ (ϕ Γ ∪ ϕ (c̃)) and K(ϕ Γ ∪ ϕ (c̃)) ↓= K ′(ϕ Γ ∪ ϕ (c̃)).
S ′, K ′ without destructors, such that S(ϕ LL
l
l
l
l
LL
LL
LL
Hence, using Lemma B.46, we have
Γ
Γ
Γ
Γ
sign(M, k) = S(ϕ LL
∪ ϕ r (Jc̃Kσ , σ ′ )) ↓= S((ϕ LL
∪ ϕ r (c̃))σ ) ↓= (S(ϕ LL
∪ ϕ l(c̃)) ↓)σ = S ′ (ϕ LL
∪ ϕ l(c̃))σ
Γ ∪ ϕ (c̃))σ = sign(M, k), and considering that step3 (c̃) holds there exists a variable x such that either S ′ = x and
Since S ′ (ϕ LL
l
Γ
Γ (x) = k (similarly to the previous
ϕ l(c̃)(x) = sign(M ′, k) for some message M ′ ; or S ′ = sign(S ′′, x) (for some recipe S ′′ ) and ϕ LL
case).
Γ ∪ ϕ (c̃)) is a signature by k. That is to say S(ϕ Γ ∪ ϕ (c̃)) ↓ is a signature by k.
In any case S ′ (ϕ LL
l
l
LL
Γ ∪ ϕ (c̃)) ↓= vk(k).
Similarly to the asymmetric encryption case, we can also show that K(ϕ LL
l
Γ ∪ ϕ (c̃)) ↓= (checksign(S, K))(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥.
Therefore, R(ϕ LL
l
l
LL
• if the head symbol of R is π1 , π2 : all these cases are similar, we detail the proof for the π1 case. We have R = π1 (S) for some recipe S.
Γ ∪ ϕ (Jc̃K
Γ
Since R(ϕ LL
r
σ , σ ′ )) ↓, ⊥, we know that S(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓= hM, N i for some messages M, N .
Γ ∪ ϕ (c̃)) ↓, ⊥. Hence, by Lemma B.45, there exists a recipe S ′ without destructors,
By the induction hypothesis, we thus have S(ϕ LL
l
Γ ∪ ϕ (c̃)) ↓= S ′ (ϕ Γ ∪ ϕ (c̃)).
such that S(ϕ LL
l
l
LL
Hence, using Lemma B.46, we have
Γ ∪ ϕ (Jc̃K
Γ
Γ
′ Γ
hM, N i = S(ϕ LL
r
σ , σ ′ )) ↓= S((ϕ LL ∪ ϕ r (c̃))σ ) ↓= (S(ϕ LL ∪ ϕ l(c̃)) ↓)σ = S (ϕ LL ∪ ϕ l(c̃))σ
Γ ∪ϕ (c̃))σ = hM, N i, and cconsidering that step3 (c̃) holds there exist some recipes S ′′ and S ′′′ such that S ′ = hS ′′ , S ′′′ i.
Since S ′(ϕ LL
l
Γ
Γ ∪ ϕ (c̃)) ↓ is a pair.
That is to say S(ϕ LL
l

Γ ∪ ϕ (c̃)) ↓= (π (S))(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥.
Therefore, R(ϕ LL
1
l
l
LL


Γ ∪ϕ (c̃)), R(ϕ Γ ∪ϕ (Jc̃K
Γ
Lemma B.48. For all σ , σ ′ , for all recipe R such that vars(R) ⊆ dom(ϕ LL
l
l
σ , σ ′ )) ↓, ⊥ and R(ϕ LL ∪ϕ r (Jc̃Kσ , σ ′ )) ↓, ⊥,
LL
there exists a recipe R ′ without destructors, i.e. in which dec, adec, checksign, π1 , π2 , do not appear, such that
Γ ∪ ϕ (c̃)),
• vars(R ′ ) ⊆ dom(ϕ LL
l
′ Γ
Γ ∪ ϕ (Jc̃K
• R(ϕ LL
l
σ , σ ′ )) ↓= R (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )),
Γ ∪ ϕ (Jc̃K
′ Γ
• R(ϕ LL
r
σ , σ ′ )) ↓= R (ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )).
Γ ∪ ϕ (c̃)) ↓, ⊥ and R(ϕ Γ ∪ ϕ (c̃)) ↓, ⊥.
Proof. By Lemma B.47, R(ϕ LL
r
l
LL
Hence we may apply Lemma B.45, and there exists a recipe R ′ without destructors, such that
Γ ∪ ϕ (c̃)),
• vars(R ′ ) ⊆ dom(ϕ LL
l
Γ
Γ ∪ ϕ (c̃)),
• R(ϕ LL ∪ ϕ l(c̃)) ↓= R ′ (ϕ LL
l
Γ ∪ ϕ (c̃)) ↓= R ′ (ϕ Γ ∪ ϕ (c̃)).
• R(ϕ LL
r
r
LL
By Lemma B.46, we have
Γ
Γ
Γ
(R(ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ ))) ↓= (R(ϕ LL
∪ ϕ l(c̃))σ ) ↓= (R(ϕ LL
∪ ϕ l(c̃)) ↓)σ

Hence
Γ
Γ
Γ
∪ ϕ l(Jc̃Kσ , σ ′ ))) ↓= R ′ (ϕ LL
∪ ϕ l(c̃))σ = R ′ (ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ )).
(R(ϕ LL

Similarly we can show that
Γ
Γ
(R(ϕ LL
∪ ϕ r (Jc̃Kσ , σ ′ ))) ↓= R ′ (ϕ LL
∪ ϕ r (Jc̃Kσ , σ ′ )).

This proves the claim.



Γ ∪ ϕ (c̃)), for all x ∈ dom(ϕ Γ ∪ ϕ (c̃)), if R(ϕ Γ ∪ ϕ (Jc̃K
Lemma B.49. For all σ , σ ′ , for all recipe R such that vars(R) ⊆ dom(ϕ LL
l
l
l
σ,σ ′) =
LL
LL
Γ ∪ ϕ (Jc̃K
Γ ∪ ϕ (c̃)), or R ∈ C ∪ F N .
))(x)
then
R
is
a
variable
y
∈
dom(ϕ
(ϕ LL
′
l
l
σ,σ
LL
Γ ∪ ϕ (Jc̃K
Γ
Γ
Similarly, if R(ϕ LL
r
σ , σ ′ ) = (ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ ))(x) then R is a variable y ∈ dom(ϕ LL ∪ ϕ r (c̃)) or R ∈ C ∪ F N .

Proof. We only detail the proof for ϕ l(Jc̃Kσ , σ ′ ), as the proof for ϕ r (c̃) is similar.
We distinguish several cases for R.
• If R = a ∈ C ∪ F N : the claim clearly holds.
• If R = x ∈ AX then the claim trivially holds.
Γ ∪ϕ (Jc̃K
• If R = enc(S, K) or sign(S, K) for some recipes S, K: these two cases are similar, we only detail the encryption case. (ϕ LL
l
σ , σ ′ ))(x)
Γ ∪ ϕ (Jc̃K
is then an encrypted message, which, because of the form of c̃, implies that K(ϕ LL
l
σ , σ ′ )) = k for some k ∈ K such that
Γ ∪ ϕ (Jc̃K
Γ(k) = keyHH (T ) for some T . This is only possible if there exists a variable z such that K = z and (ϕ LL
l
σ , σ ′ ))(z) = k, which,
LL
Γ
′
′
by step3 Γ (c̃) and the deﬁnition of ϕ LL , implies that Γ(k) = key (T ) for some T , which is contradictory.
Γ ∪ϕ (Jc̃K
• If R = aenc(S, K) or h(S) for some recipes S, K: these two cases are similar, we only detail the encryption case. (ϕ LL
l
σ , σ ′ ))(x)
Γ ∪ ϕ (Jc̃K
is then an asymmetrically encrypted message, which, because of the form of c̃, implies that S(ϕ LL
l
σ , σ ′ )) contains directly
HH, a
HH
under pairs a nonce n such that Γ(n) = τn , or a key k ∈ K such that Γ(k) = key (T ) for some T . This is only possible if there
Γ ∪ ϕ (Jc̃K
exists a recipe S ′ such that S(ϕ LL
l
σ , σ ′ )) = n (resp. k).
Γ ∪ ϕ (Jc̃K
Since R can only contain names from F N , this implies that there exists a variable z such that (ϕ LL
l
σ , σ ′ ))(z) = n (resp. k),
Γ , implies that Γ(n) = τ LL, a (resp. Γ(k) = keyLL (T ′ ) for some T ′ ), which is contradictory.
which, by step3 Γ (c̃), and the deﬁnition of ϕ LL
n
• Finally, the head symbol of R cannot be h·, ·i, dec, adec, checksign, π1 , π2 , because of the form of c̃ (step3 Γ (c̃)).


We now assume that step4 Γ (c̃) holds. Note that since Γ, and hence Γ, do not contain reﬁnements or nonces with inﬁnite nonce types,
the step4Γ (c̃) condition is simpler than in the general case. Indeed the condition on the most general uniﬁer µ is always trivially satisﬁed,
and the substitution θ is the identity.
Γ ∪ ϕ (Jc̃K
Γ
Lemma B.50. For all σ , σ ′ such that ∃Γ ′ ⊆ Γ. ∃c σ . Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c σ , the frames new EΓ . ϕ LL
l
σ , σ ′ ) and new EΓ . ϕ LL ∪
ϕ r (Jc̃Kσ , σ ′ ) are statically equivalent.

Γ ∪ ϕ (Jc̃K
Γ
Proof. Let R, S be two recipes such that vars(R) ∪ vars(S) ⊆ dom(ϕ LL
l
σ , σ ′ )) = dom(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )).
Let us show that
Γ
Γ
(R(ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ ))) ↓= (S(ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ ))) ↓ ⇐⇒

Γ
Γ
∪ ϕ r (Jc̃Kσ , σ ′ ))) ↓= (S(ϕ LL
∪ ϕ r (Jc̃Kσ , σ ′ ))) ↓
(R(ϕ LL

Γ ∪ ϕ (Jc̃K
Γ
We only detail the proof for the (⇒), as the other direction is similar. We then assume that (R(ϕ LL
l
σ , σ ′ ))) ↓= (S(ϕ LL ∪
ϕ l(Jc̃Kσ , σ ′ ))) ↓.
Let us ﬁrst note that
Γ
Γ
∪ ϕ l(c̃))) ↓, ⊥ ⇐⇒ (R(ϕ LL
∪ ϕ r (c̃))) ↓, ⊥.
(R(ϕ LL

This follows from Lemmas B.42 and B.21.
Since Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c σ , as by deﬁnition we only type messages, σ and σ ′ only contain messages. Hence, by Lemmas B.47
and B.46,
Γ
R(ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ )) ↓, ⊥

⇐⇒

Γ
∪ ϕ l(c̃)) ↓, ⊥
R(ϕ LL

Γ
∪ ϕ r (Jc̃Kσ , σ ′ )) ↓, ⊥
R(ϕ LL

⇐⇒

Γ
∪ ϕ r (c̃)) ↓, ⊥.
R(ϕ LL

and
Hence, by chaining all these equivalences, we have
Γ
R(ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ )) ↓, ⊥

⇐⇒

Γ
R(ϕ LL
∪ ϕ r (Jc̃Kσ , σ ′ )) ↓, ⊥.

Γ
S(ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ )) ↓, ⊥

⇐⇒

Γ
∪ ϕ r (Jc̃Kσ , σ ′ )) ↓, ⊥.
S(ϕ LL

Similarly, we can show that

Γ ∪ ϕ (Jc̃K
Γ
Γ
Γ
Therefore, if R(ϕ LL
l
σ , σ ′ )) ↓= ⊥, i.e. S(ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )) ↓= ⊥, then R(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓= S(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓= ⊥, and the
claim holds.
Γ ∪ ϕ (Jc̃K
Γ
Γ
Let us now assume that R(ϕ LL
l
σ , σ ′ )) ↓, ⊥, then R(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓, ⊥ and S(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓, ⊥.
By Lemma B.48, there exist R ′ , S ′ without destructors such that
Γ ∪ ϕ (c̃)) and vars(S ′ ) ⊆ dom(ϕ Γ ∪ ϕ (c̃)),
• vars(R ′ ) ⊆ dom(ϕ LL
l
l
LL
Γ ∪ ϕ (Jc̃K
′ (ϕ Γ ∪ ϕ (Jc̃K
))
↓=
R
)),
• R(ϕ LL
′
′
l
l
σ,σ
σ,σ
LL
Γ ∪ ϕ (Jc̃K
′ Γ
• R(ϕ LL
r
σ , σ ′ )) ↓= R (ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )).
′ Γ
Γ ∪ ϕ (Jc̃K
• S(ϕ LL
l
σ , σ ′ )) ↓= S (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )),
Γ ∪ ϕ (Jc̃K
′ Γ
• S(ϕ LL
r
σ , σ ′ )) ↓= S (ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )).
Γ ∪ ϕ (Jc̃K
Γ
′ Γ
′ Γ
Since (R(ϕ LL
l
σ , σ ′ ))) ↓= (S(ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ ))) ↓, we have R (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )) = S (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )).
′ Γ
′ ′
′ Γ
′ Γ
Γ ∪ ϕ (Jc̃K
We show that R ′ (ϕ LL
r
σ , σ ′ )) = S (ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )). by induction on the recipes R , S . Since R (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )) = S (ϕ LL ∪
′
′
ϕ l(Jc̃Kσ , σ ′ )), we can distinguish four cases for R and S .

• If they have the same head symbol, either this symbol is a nonce or constant and the claim is trivial, or it is a variable, and we handle
this case later, or it is a destructor or constructor. We write the proof for this last case generically for R ′ = f (R ′′ ) and S ′ = f (S ′′ ).
′′ Γ
′′
Γ ∪ ϕ (Jc̃K
We have necessarily R ′′ (ϕ LL
l
σ , σ ′ )) = S (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )). It then follows by applying the induction hypothesis to R and
Γ ∪ ϕ (Jc̃K
′′ Γ
S ′′ that R ′′ (ϕ LL
r
σ , σ ′ )) = S (ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )). The claim follows by applying f on both sides of this equalities.
′
′
• If R is a variable and not S : then by Lemma B.49, S ′ ∈ C ∪ F N . Let us denote R ′ = x. By Lemma B.42, there exists c x such that
Γ ∪ ϕ (c̃))(x) ∼ (ϕ Γ ∪ ϕ (c̃))(x) : LL → c . Since (ϕ Γ ∪ ϕ (c̃))(x) = R ′ (ϕ Γ ∪ ϕ (c̃)) = S ′ (ϕ Γ ∪ ϕ (c̃)) ∈ C ∪ F N , by
Γ ⊢ (ϕ LL
x
r
l
l
l
l
LL
LL
LL
LL
Γ ∪ ϕ (c̃))(x) = S ′ (ϕ Γ ∪ ϕ (c̃)), i.e. R ′ (ϕ Γ ∪ ϕ (c̃)) = S ′ (ϕ Γ ∪ ϕ (c̃)).
Lemma B.18, we have (ϕ LL
r
r
r
l
LL
LL
LL
• If S ′ is a variable and not R ′ : this case is similar to the previous one.
Γ ∪ϕ (Jc̃K
Γ
Γ
• If R ′ , S ′ are two variables x and y, we have (ϕ LL
l
σ , σ ′ ))(x) = (ϕ LL ∪ϕ l(Jc̃Kσ , σ ′ ))(y). We can then prove (ϕ LL ∪ϕ r (Jc̃Kσ , σ ′ ))(x) =
Γ ∪ ϕ (Jc̃K
(ϕ LL
r
σ , σ ′ ))(y). Indeed:
Γ ), this follows from the deﬁnition of ϕ Γ .
– if x, y ∈ dom(ϕ LL
LL
′ Γ
Γ ) and y ∈ dom(ϕ (Jc̃K
Γ
Γ
– if x ∈ dom(ϕ LL
l
σ , σ ′ )): then by deﬁnition of ϕ LL , R (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )) = ϕ LL (x) is a nonce, key, public
key, or veriﬁcation key. Hence ϕ l(Jc̃Kσ , σ ′ )(y) is also a nonce, key, public key or veriﬁcation key. By step3 Γ (c̃), ϕ l(Jc̃Kσ , σ ′ )(y) =
ϕ l(c̃)(y). This implies that ϕ l(c̃)(y) is also a nonce, key, public key or veriﬁcation key. By Lemma B.42, there exists cy such that
Γ ⊢ ϕ l(c̃)(y) ∼ ϕ r (c̃)(y) : LL → cy , and hence by Lemma B.18, ϕ r (c̃)(y) = ϕ l(c̃)(y). That is to say
Γ
Γ
Γ
Γ
Γ
∪ ϕ r (Jc̃Kσ , σ ′ ) = (ϕ LL
∪ ϕ r (Jc̃Kσ , σ ′ )(x) = ϕ LL
(x) = (ϕ LL
∪ ϕ l(Jc̃Kσ , σ ′ ))(y) = ϕ l(c̃)(y) = ϕ r (c̃)(y) = S ′ (ϕ LL
∪ ϕ r (Jc̃Kσ , σ ′ ).
R ′ (ϕ LL

– if x, y ∈ dom(ϕ l(Jc̃Kσ , σ ′ )): then there exist M ∼ M ′ ∈ c̃, N ∼ N ′ ∈ c̃ such that ϕ l(Jc̃Kσ , σ ′ )(x) = Mσ , ϕ r (Jc̃Kσ , σ ′ )(x) = M ′σ ′ ,
ϕ l(Jc̃Kσ , σ ′ )(y) = N σ , ϕ r (Jc̃Kσ , σ ′ )(y) = N ′σ ′ . Since Mσ = N σ , M, N are uniﬁable, let µ be their most general uniﬁer. There exists
θ such that σ = µθ.
Let then α be the restriction of µ to {x ∈ vars(M) ∪ vars(N ) | Γ(x) = LL ∧ µ(x) ∈ N is a nonce}.
By step4 Γ (c̃), we have M ′α = N ′α.
Let x ∈ dom(α). Then µ(x) = n for some n ∈ N . Thus σ (x) = µ(x)θ = n.
Since, by assumption, ∃Γ ′ ⊆ Γ. ∃c σ . Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c σ , there exists some c x such that ∅ ⊢ n ∼ σ ′ (x) : LL → c x .
Hence by Lemma B.18, σ ′ (x) = n = µ(x) = α(x).
Since this holds for any x ∈ dom(α), we have ασ ′ = σ ′ .
Therefore, since M ′α = N ′α, we have M ′ασ ′ = N ′ασ ′ , i.e. M ′σ ′ = N ′σ ′ . This proves the claim.
Γ ∪ ϕ (Jc̃K
Γ
Γ
′ Γ
Finally, since R ′ (ϕ LL
l
σ , σ ′ )) = S (ϕ LL ∪ ϕ l(Jc̃Kσ , σ ′ )), we have R(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓= S(ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ )) ↓.
This proves the property.



Lemma B.51. c is consistent in Γ.
Proof. By Lemmas B.38 and B.40, it suﬃces to show that c̃ is consistent in Γ.
Let c ′ ⊆ c̃, Γ ′ ⊆ Γ be such that vars(c ′ ) ⊆ dom(Γ ′ ). Let σ , σ ′ be such that Γ ′ N, K ⊢ σ ∼ σ ′ : Γ ′ X → c σ for some c σ .
Γ ∪ ϕ (Jc̃K
Γ
By Lemma B.50, the frames new EΓ . ϕ LL
l
σ , σ ′ ) and new EΓ . ϕ LL ∪ ϕ r (Jc̃Kσ , σ ′ ) are statically equivalent.
Γ ∪ϕ (Jc ′ K
Γ
′
Since the frames new EΓ . ϕ LL
l
σ , σ ′ ) and new EΓ . ϕ LL ∪ϕ r (Jc Kσ , σ ′ ) are subsets of these frames, they also are statically equivalent.

Therefore c̃ is consistent in Γ.

This next theorem corresponds to Theorem 6.4.
Theorem B.52 (Soundness of the procedure). Let C be a constraint set without inﬁnite nonce types, i.e.
′

l, ∞
∀(c, Γ) ∈ C. ∀l, l ′, m, n.Γ(x) , Jτm
; τnl , ∞ K.

If check_const(C) succeeds, then C is consistent.

Proof. The previous lemmas directly imply that for all (c, Γ) ∈ C, c is consistent in Γ. This proves the theorem.

B.4



Consistency for replicated processes

In this subsection, we prove the results regarding the procedure when checking consistency in the replicated case.
In this subsection, we only consider constraints obtained by typing processes (with the same key types). Notably, by the well-formedness
assumptions on the processes, this means that a nonce n is always associated with the same nonce type.
This theorem corresponds to Theorem 6.5.
Theorem B.53. Let C and C ′ be two constraint sets such that
∀(c, Γ) ∈ C. ∀(c ′, Γ ′ ) ∈ C ′. dom(ΓX ) ∩ dom(Γ ′ X ) = ∅.
For all n ∈ N, if check_const([ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 ) = true, then check_const(∪×1≤i ≤n [ C ]ni )∪× [ C ′ ]n1 ) = true.
Proof. Let n ∈ N. Let C be such that ∀(c, Γ) ∈ C. ∀(c ′, Γ ′ ) ∈ C ′. dom(Γ) ∩ dom(Γ ′ ) = ∅.
Let (c, Γ) ∈ (∪×1≤i ≤n [ C ]ni )∪× [ C ′ ]n1 . By deﬁnition of ∪× , there exists (c ′, Γ ′ ) ∈ [ C ′ ]n1 , and for all i ∈ J1, nK, there exists (ci , Γi ) ∈ [ C ]ni ,
such that
• c = (∪1≤i ≤n ci ) ∪ c ′ ;
• Γ = (⊎1≤i ≤n Γi ) ⊎ Γ ′ .
Let i ∈ J1, nK. Since (ci , Γi ) ∈ [ C ]ni , by deﬁnition of [ C ]ni there exists (ci′, Γi′ ) ∈ C such that
 Γ
• ci = ci′ i i ;
 n
• Γi ∈ branches( Γi′ i ).
Note that this implies dom(Γi X ) only contains variables indexed by i, and, from the assumption that vars(ci′) ⊆ dom(Γi′ X ), that vars(ci ) ⊆
dom(Γi X ).
For all i ∈ J1, nK, let δ i1 denote the function on terms which consists in exchanging all occurrences of the indices i and 1, i.e. replacing
any occurrence of m i (for all nonce m with an inﬁnite nonce type) with m 1 , any occurrence of m 1 with m i , any occurrence of xi with x 1
(for all variable x), and any occurrence of x 1 with xi (also for all variable x).
We also (abusing notations) apply this function to constraints, types, typing environments and constraint sets. In the case of types we
use it to denote the replacement of nonces appearing in the reﬁnements. In the case of typing environments it denotes the replacement of

nonces appearing in the types, and of nonces and variables in the domain of the environment, i.e. (δ i1 (Γ))(x 1 ) = δ i1 (Γ(xi )). In the case of
constraint sets it denotes the application of the function to each constraint and environment in the constraint set.
Similarly, we denote δ i2 the function exchanging indices i and 2.
For all h ∈ J1, nK and all i , j ∈ J1, nK, such that i , 2 and j , 1, let
i, j

i, j

(ch , Γh ) = (ch , Γh )δ i1δ j2 .

Similarly, for all h ∈ J1, nK and all i ∈ J1, nK, let

(chi,i , Γhi,i ) = (ch , Γh )δ i1 .

Finally, for all i ∈ J1, nK, let Γ ′i be the typing environment such that dom(Γ ′i ) = dom(Γ ′ ) and ∀x ∈ dom(Γ ′i ). Γ ′i (x) = Γ ′ (x)δ i1 .
 Γ
i, j i, j
Since (ci , Γi ) ∈ [ C ]ni , we can show that (ci , Γi ) ∈ [ C ]n1 . Indeed, recall that there exists (ci′, Γi′ ) ∈ C such that ci = ci′ i i and
 n
 Γ
i, j
Γi ∈ branches( Γi′ i ). ci only contains variables and names indexed by i, hence it is clear that ci = ci′ 1i . Moreover, since Γi ∈
 n
 n
 n
i, j
branches( Γi′ i ), it is clear that Γi ∈ branches( Γi′ i δ i1δ j2 ). By deﬁnition, indexed nonces or variables appear in Γi′ i only in its
domain, and as parts of union types of the form J m 1 ; p 1 K ∨ . . . J m n ; pn K. This union type is left unchanged by δ i1δ j2 : since i , j,
 n
 n
 n
i, j
i , 2, and j , 1, δ i1δ j2 is indeed only performing a permutation of the indices. Hence, Γi′ i δ i1δ j2 = Γi′ 1 . Thus Γi ∈ branches( Γi′ 1 ).
i, j

i, j

Therefore, (ci , Γi ) ∈ [ C ]n1 .
i, j
i, j
i, j
Note that dom(Γi ) only contains variables indexed by 1; and that, since vars(ci ) ⊆ dom(Γi ), we have vars(ci ) ⊆ dom(Γi ).
i, j
i, j
i, j i, j
Similarly, if j , i, i , 2 and j , 1, (c j , Γj ) ∈ [ C ]n2 . Note that dom(Γj ) only contains variables indexed by 2; and that vars(c j ) ⊆
i, j

dom(Γj ).
Similarly, we also have (c ′, Γ ′ i ) ∈ [ C ′ ]n1 .
Note that for all (c ′′, Γ ′′ ) ∈ [ C ]n1 , and all (c ′′′ , Γ ′′′ ) ∈ [ C ′ ]n1 , and since by assumption:
∀(c, Γ) ∈ C. ∀(c ′, Γ ′ ) ∈ C ′. dom(Γ) ∩ dom(Γ ′ ) = ∅,
i, j

i, j

we know that Γ ′′ and Γ ′′′ are compatible. In particular this applies to all the Γi and Γ ′ (as well as Γi and Γ ′i ).
Moreover, for all (c ′′ , Γ ′′ ) ∈ [ C ]n2 , and all (c ′′′, Γ ′′′ ) ∈ [ C ′ ]n1 , since dom(Γ ′′′ ) ⊆ {x 1 | x ∈ X}, and dom(Γ ′′ ) ⊆ {x 2 | x ∈ X}, Γ ′′ and Γ ′′′
i, j
i, j
are also compatible. This in particular applies to Γj for all i , j ∈ J1, nK and Γ ′ (as well as Γj and Γ ′i ).
If C is empty, then so is ∪×1≤i ≤n [ C ]ni and the claim clearly holds. Let us now assume that C is not empty. Hence for all i ∈ J1, nK, [ C ]ni
is not empty.
The procedure for c, Γ is as follows:
(1) We compute step1Γ (c). Following the notations used in the procedure, we have
′

def

and we write (c, Γ) = step1 Γ (c).

l, 1
F = {x ∈ dom(Γ) | ∃m, n, l, l ′ . Γ(x) = Jτm
; τnl , 1 K},
′ def

def

′

For all i ∈ J1, nK, let (ci , Γi ) = step1 Γi (ci ). Let also (c ′, Γ ) = step1 Γ′ (c ′ ). We have c = (∪1≤i ≤n ci ) ∪ c ′ , and Γ = (∪1≤i ≤n Γi ) ∪ Γ .
i, j

i, j def

i, j

For all h, i, j ∈ J1, nK, such that either i , j and i , 2 and j , 1, or i = j, let also (c h , Γ h ) = step1 Γi, j (ch ). Similarly, for all i ∈ J1, nK,
h
i

i def

i, j

i, j

let also (c ′ , Γ ′ ) = step1 Γ′ i (c ′ ). Since, for i , j, (ch , Γh ) = (ch , Γh )δ i1δ j2 , it can easily be shown (by induction on the terms) that
i,i
i
i
′
i, j i, j
(c h , Γh ) = (ch , Γh )δ i1δ j2 . Similarly, (c hi,i , Γ h ) = (ch , Γh )δ i1 . Finally, we similarly also have (c ′ , Γ ′ ) = (c ′, Γ )σp1 .
def

(2) We compute c̃ = step2 Γ (c).
i, j
Note that, by the assumption that C and C ′ are obtained by typing processes, all the environments Γ, Γi , Γ ′ , Γh , Γhi,i , Γi′ contain
′ i, j i,i ′
the same keys, associated with the same labels. The same is thus true for Γ, Γi , Γ , Γ h , Γh , Γ i . Hence, step2 Γ , step2 Γ , step2 Γ′ ,
i
step2 i, j , step2 i, i , step2 Γ′ all denote the same function.
Γh

Γh

i

def

For all i ∈ J1, nK, let cei = step2 Γ (ci ). Similarly, let c̃ ′ = step2 Γ (c ′). It is clear that c̃ = (∪1≤i ≤n cei ) ∪ c̃ ′.

i def
i
i, j
i, j def
Similarly, for all h, i, j ∈ J1, nK, such that either i , j and i , 2 and j , 1, or i = j, let e
ch = step2 Γ (c h ). Let also ce′ = step2 Γ (c ′ ).
i, j

i, j

It can easily be seen that for all h ∈ J1, nK, all i , j ∈ J1, nK such that i , 2 and j , 1, since c h = ch δ i1δ j2 , we have e
ch = ceh δ i1δ j2 .
i
Similarly, e
c i,i = ceh δ 1 . Finally, we similarly also have ce′ = c̃ ′δ 1 .
h

i

i

(3) We check that step3 Γ (c̃) holds, i.e. that each M ∼ N ∈ c̃ has the correct form (with respect to the deﬁnition of step3).
If M ∼ N ∈ c̃, either M ∼ N ∈ c̃ ′ , or there exists i ∈ J1, nK such that M ∼ N ∈ cei .
• In the ﬁrst case, M ∼ N ∈ c̃ ′. By assumption, [ C ]n1 and [ C ]n2 are not empty. Hence there exist (c ′′, Γ ′′ ) ∈ [ C ]n1 and (c ′′′ , Γ ′′′ ) ∈
[ C ]n2 . Thus, (c ′′ ∪ c ′′′ ∪ c ′, Γ ′′ ∪ Γ ′′′ ∪ Γ ′ ) ∈ [ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 (as noted previously, Γ ′′ , Γ ′′′ , and Γ ′ are compatible). Hence,
by assumption, check_const({(c ′′ ∪ c ′′′ ∪ c ′, Γ ′′ ∪ Γ ′′′ ∪ Γ ′ )}) succeeds.
If c̃ ′′ = step2 Γ (f st(step1Γ′′ (c ′′ ))), and c̃ ′′′ = step2 Γ (f st(step1Γ′′′ (c ′′′ ))), then c̃ ′′ ∪ c̃ ′′′ ∪ c̃ ′ = step2 Γ (f st(step1Γ′′ ∪Γ′′′ ∪Γ′ (c ′′ ∪
c ′′′ ∪ c ′ ))). Therefore, step3 Γ (c̃ ′′ ∪ c̃ ′′′ ∪ c̃ ′) = true.
In particular, M ∼ N ∈ c̃ ′ has the correct form.
• In the second case, M ∼ N ∈ cei for some i ∈ J1, nK.
Let M ′ = Mδ i1 and N ′ = N δ i1 . Since e
cii,i = cei δ i1 , we have M ′ ∼ N ′ ∈ e
cii,i .
n
n
By assumption, [ C ]2 is not empty, hence there exists (c ′′, Γ ′′ ) ∈ [ C ]2 . Thus, (cii,i ∪c ′′ ∪c ′, Γii,i ∪Γ ′′ ∪Γ ′ ) ∈ [ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1
(as noted previously, Γii,i , Γ ′′ , and Γ ′ are compatible). Hence, by assumption, check_const({(cii,i ∪c ′′ ∪c ′, Γii,i ∪Γ ′′ ∪Γ ′ )}) succeeds.
cii,i ∪e
c ′′ ∪c̃ ′ = step2 Γ (f st(step1Γi,′′1 ∪Γ′′ ∪Γ′ (e
cii,i ∪e
c ′′ ∪c̃ ′ )
cii,i ∪c ′′ ∪c ′ )). Therefore, step3 Γ (e
Ife
c ′′ = step2Γ (f st(step1 Γ′′ (c ′′ ))), then e
holds.
In particular, M ′ ∼ N ′ ∈ e
cii,i , has the correct form. It follows by examining all the cases and using the fact that for all m i , m j , if m i
′

l, a
l ,a
is associated with the type τm
and m j with τm
then l = l ′, that M ∼ N also has the correct form.
i
j
Therefore, step3 Γ (c̃) holds.

(4) Finally, we check that step4 Γ (c̃) holds. Let M 1 ∼ N 1 ∈ c̃ and M 2 ∼ N 2 ∈ c̃. Let us prove the property in the case where M 1 and M 2
are uniﬁable with a most general uniﬁer µ. The case where N 1 and N 2 are uniﬁable is similar.
Let then α be the restriction of µ to {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ(x) = LL ∧ µ(x) ∈ N }.
We have prove that N 1α = N 2α.
Since we already have c̃ = (∪1≤i ≤n cei ) ∪ c̃ ′ , we know that:
• either there exists i ∈ J1, nK such that M 1 ∼ N 1 ∈ cei ;
• or M 1 ∼ N 1 ∈ c̃ ′ ;
and
• either there exists j ∈ J1, nK such that M 2 ∼ N 2 ∈ cej ;
• or M 2 ∼ N 2 ∈ c̃ ′ .
Let us ﬁrst prove the case where there exist i, j ∈ J1, nK such that M 1 ∼ N 1 ∈ cei and M 2 ∼ N 2 ∈ cej . We distinguish two cases.
• if i , j: The property to prove is symmetric between M 1 ∼ N 1 ∈ c̃ and M 2 ∼ N 2 ∈ c̃. Hence without loss of generality we may
assume that i , 2 and j , 1. Indeed, if we assume that the property can be proved in that case, then in the case where i = 2 or
j = 1, we may exchange the two constraints. The property holds for M 2 ∼ N 2 ∈ cej and M 1 ∼ N 1 ∈ cei : as i , j, and i = 2 or j = 1,
we know that i , 1 and j , 2. Then by symmetry it also holds for M 1 ∼ N 1 ∈ cei and M 2 ∼ N 2 ∈ cej .
Let us hence assume that i , 2 and j , 1.
Let then M 1′ = M 1δ i1δ j2 , N 1′ = N 1δ i1δ j2 , M 2′ = M 2δ i1δ j2 , N 2′ = N 2δ i1δ j2 .
i, j

i, j

i, j

Since e
ci = cei δ i1δ j2 , we have M 1′ ∼ N 1′ ∈ e
ci . Similarly, M 2′ ∼ N 2′ ∈ e
cj .
Since M 1 and M 2 are uniﬁable, then so are M 1′ and M 2′ , with a most general uniﬁer µ ′ which satisﬁes µ(x) = t ⇔ µ ′ (xδ i1δ j2 ) = tδ i1δ j2 .
i, j

i, j

Let then α ′ be the restriction of µ ′ to {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | (Γi ∪ Γ j )(x) = LL ∧ µ ′ (x) ∈ N is a nonce}.
Similarly α ′ is such that ∀x ∈ dom(α ′ ).∀n. α(x) = n ⇔ α ′ (xδ i1δ j2 ) = nδ i1δ j2 , i.e. δ i1δ j2α ′δ i1δ j2 = α.
i, j

i, j

i, j

i, j

i, j

i, j

i, j

i, j

By assumption, check_const({(ci ∪c j ∪c ′, Γi ∪Γj ∪Γ ′ )}) succeeds since (ci ∪c j ∪c ′, Γi ∪Γj ∪Γ ′ ) ∈ [ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 .
i, j
i, j
i, j
i, j
c j ∪ c̃ ′) holds, and since {M 1′ ∼ N 1′, M 2′ ∼ N 2′ } ⊆ e
c ∪e
c j ∪ c̃ ′, we know that since M 1′ , M 2′ are
ci ∪ e
Thus, step4 i, j i, j ′ (e
Γ i ∪Γ j ∪Γ i
uniﬁable, N 1′α ′ = N 2′α ′ .
Thus N 1′α ′δ i1δ j2 = N 2′α ′δ i1δ j2 , i.e., since i , j, and δ i1δ j2 α ′δ i1δ j2 = α, N 1α = N 2α. Therefore the claim holds in this case.
cii,i = cei δ i1 , we have M 1′ ∼ N 1′ ∈ e
cii,i . Similarly,
• if i = j then let M 1′ = M 1δ i1 , N 1′ = N 1δ i1 , M 2′ = M 2δ i1 , N 2′ = N 2δ i1 . Since e
i,i
′
′
M2 ∼ N2 ∈ e
ci .
Since M 1 and M 2 are uniﬁable, then so are M 1′ and M 2′ , with a most general uniﬁer µ ′ which satisﬁes µ(x) = t ⇔ µ ′ (xδ i1 ) = tδ i1 .
i,i

Let then α ′ be the restriction of µ ′ to {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | Γi (x) = LL ∧ µ ′ (x) ∈ N is a nonce}.
Similarly α ′ is such that ∀x ∈ dom(α ′ ).∀n. α(x) = n ⇔ α ′ (xδ i1 ) = nδ i1 , i.e. δ i1α ′δ i1 = α.
By assumption, [ C ]n2 is not empty, hence there exists (c ′′, Γ ′′ ) ∈ [ C ]n2 . Thus, (cii,i ∪c ′′ ∪c ′, Γii,i ∪Γ ′′ ∪Γ ′ ) ∈ [ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 .
cii,i ∪e
c ′′ ∪c̃ ′ =
Hence, by assumption, check_const({(cii,i ∪c ′′ ∪c ′, Γii,i ∪Γ ′′ ∪Γ ′ )}) succeeds. Ife
c ′′ = step2Γ (f st(step1 Γ′′ (c ′′ ))), thene
step2 Γ (f st(step1Γi, i ∪Γ′′∪Γ′ (cii,i ∪ c ′′ ∪ c ′ ))).
i

c i,i ∪ e
c ′′ ∪ c̃ ′) holds, and since {M 1′ ∼ N 1′, M 2′ ∼ N 2′ } ⊆ e
cii,i ∪ e
c ′′ ∪ c̃ ′, we
i, i
′′
′ (e
Γ i ∪Γ ∪Γ i
Thus N 1′α ′δ i1 = N 2′α ′δ i1 , i.e., since δ i1 α ′δ i1 , N 1α = N 2α. Therefore the claim holds in this case.

Thus, step4

know that N 1′α ′ = N 2′α ′ .

Let us now prove the case where there exists i ∈ J1, nK such that M 1 ∼ N 1 ∈ cei , and M 2 ∼ N 2 ∈ c̃ ′ . The symmetric case, where
M 1 ∼ N 1 ∈ c̃ ′ and there exists j ∈ J1, nK such that M 2 ∼ N 2 ∈ cej , is similar.
i
Let then M ′ = M 1δ 1 , N ′ = N 1δ 1 , M ′ = M 2δ 1 , N ′ = N 2δ 1 . Since e
c i,i = cei δ 1 , we have M ′ ∼ N ′ ∈ e
c i,i . Similarly, M ′ ∼ N ′ ∈ ce′ .
1

i

1

i

2

i

2

i

i

i

1

1

2

i

2

Since M 1 and M 2 are uniﬁable, then so are M 1′ and M 2′ , with a most general uniﬁer µ ′ which satisﬁes µ(x) = t ⇔ µ ′ (xδ i1 ) = tδ i1 .

i,i
Let then α ′ be the restriction of µ ′ to {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | (Γ i ∪ Γ ′i )(x) = LL ∧ µ ′ (x) ∈ N is a nonce}.
Similarly α ′ is such that ∀x ∈ dom(α ′ ).∀n. α(x) = n ⇔ α ′ (xδ i1 ) = nδ i1 , i.e. δ i1α ′δ i1 = α.
By assumption, [ C ]n2 is not empty, hence there exists (c ′′, Γ ′′ ) ∈ [ C ]n2 . Moreover, as noted previously, (c ′, Γ ′ i ) ∈ [ C ′ ]n1 . Thus,
(cii,i ∪ c ′′ ∪ c ′, Γii,i ∪ Γ ′′ ∪ Γ ′i ) ∈ [ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 .
i
Hence, by assumption, check_const({(c i,i ∪c ′′ ∪c ′, Γi,i ∪Γ ′′ ∪Γ ′i )}) succeeds. Ife
c ′′ = step2 (f st(step1 Γ′′ (c ′′ ))), thene
c i,i ∪e
c ′′ ∪ce′ =
i

i

step2 Γ (f st(step1 Γi, i ∪Γ′′ ∪Γ′ i (cii,i ∪ c ′′ ∪ c ′ ))).
i

i

Γ

i

i

(e
cii,i ∪ e
c ′′ ∪ ce′ ) holds, and since {M 1′ ∼ N 1′, M 2′ ∼ N 2′ } ⊆ e
cii,i ∪ e
c ′′ ∪ ce′ , we know that N 1′α ′ = N 2′α ′ .
Thus N 1′α ′δ i1 = N 2′α ′δ i1 , i.e., since δ i1α ′δ i1 = α, N 1α = N 2α.

Thus, step4

i, i
′′
i
Γ i ∪Γ ∪Γ′

Finally, only the case where M 1 ∼ N 1 ∈ c̃ ′ and M 2 ∼ N 2 ∈ c̃ ′ remains. By assumption, [ C ]n1 and [ C ]n2 are not empty, hence there
exist (c ′′, Γ ′′ ) ∈ [ C ]n1 and (c ′′′ , Γ ′′′ ) ∈ [ C ]n2 . Thus, (c ′′ ∪ c ′′′ ∪ c ′, Γ ′′ ∪ Γ ′′′ ∪ Γ ′ ) ∈ [ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 .
Hence, by assumption, check_const({(c ′′ ∪ c ′′′ ∪ c ′, Γ ′′ ∪ Γ ′′′ ∪ Γ ′ )}) succeeds. If c̃ ′′ = step2Γ (f st(step1 Γ′′ (c ′′ ))) and c̃ ′′′ =
step2 Γ (f st(step1 Γ′′′ (c ′′′ ))), then c̃ ′′ ∪ c̃ ′′′ ∪ c̃ ′ = step2 Γ (f st(step1 Γ′′ ∪Γ′′′∪Γ′ (c ′′ ∪ c ′′′ ∪ c ′))).
Thus, step4 Γ′′∪Γ′′′∪Γ′ (c̃ ′′ ∪ c̃ ′′′ ∪ c̃ ′ ) holds, and since {M 1 ∼ N 1 , M 2 ∼ N 2 } ⊆ c̃ ′′ ∪ c̃ ′′′ ∪ c̃ ′ , we know that N 1α = N 2α.
Therefore the claim holds in this case, which concludes the proof that step4 Γ (c̃) holds.
Therefore, for every (c, Γ) ∈ (∪×1≤i ≤n [ C ]ni )∪× [ C ′ ]n1 , check_const({(c, Γ)}) succeeds, which proves the claim.



This next lemma is a more general version of Theorem 6.6.
Lemma B.54. For all (c, Γ) such that vars(c) ⊆ dom(Γ) which only contains variables indexed by 1 or 2, and all names in c have ﬁnite
′
′
Ô
l, ∞
l, 1
nonce types, if check_const({(c, Γ)}) succeeds, then for all Γ ′′ ∈ branches(Γ ′ ), where Γ ′ = Γ[ 1≤i ≤n Jτm
; τpl i, 1 K / Jτm
; τpl , ∞ K]m,p ∈N ,
i
check_const({(c, Γ ′′ )}) succeeds.
Proof. Let n ∈ N.
Let (c, Γ) be as assumed in the statement of the lemma.
′
′
Ô
l, 1
l, ∞
Let us assume that check_const({(c, Γ)}) succeeds. Let Γ ′ = Γ[ 1≤i ≤n Jτm
; τpl i, 1 K / Jτm
; τpl , ∞ K]m,p ∈N , and let Γ ′′ ∈ branches(Γ ′ ).
i
The procedure check_const({(c, Γ ′′ )}) is as follows:
′′

(1) We compute (c, Γ ) = step1Γ′′ (c). Following the notations in the procedure, we denote
′
l, 1
F = {x ∈ dom(Γ ′′ ) | ∃m, p, l, l ′ . Γ ′′ (x) = Jτm
; τpl , 1 K}.
′

′

l, 1
l, ∞
Let F ′ = {x ∈ dom(Γ) | ∃m,p, l, l ′ . Γ(x) = Jτm
; τpl , 1 K}; and F ′′ = {x ∈ dom(Γ) | ∃m,p, l, l ′ . Γ(x) = Jτm
; τpl , ∞ K}.
′
′
′′
It is easily seen from the deﬁnition of Γ that F = F ⊎ F .
′′
By deﬁnition of step1 Γ′′ (c), Γ contains Γ ′′ |dom(Γ′′ )\F .
′
Let (c , Γ) = step1 Γ (c).
′
l, ∞
It is clear from the deﬁnitions of Γ ′ and Γ ′′ that for all x ∈ F ′′ , there exists i ∈ J1, nK and m, p, l, l ′ such that Γ(x) = Jτm
; τpl , ∞ K and
′

l, 1
Γ ′′ (x) = Jτm
; τpl i, 1 K. Let σ l and σ r be the substitutions deﬁned by
i

dom(σ l) = dom(σ r ) = F ′′

and

′

l, 1
∀x ∈ F ′′ .∀m,p ∈ N . ∀l, l ′ . ∀i ∈ J1, nK. Γ ′′ (x) = Jτm
; τpl i, 1 K ⇒ (σ l(x) = m i ∧ σ r (x) = pi ).
i

It is clear from the deﬁnition of c and c ′ that c = Jc ′ Kσ l, σ r .

def

(2) We compute c̃ = step2 Γ (c).
def
Similarly, let c̃ ′ = step2 Γ (c ′ ).
It can easily be seen by induction on the reduction (c, ∅)−→Γ ∗ (c 1 , c 2 ) (using the fact that −→Γ = −→Γ ) that c̃ = Jc̃ ′ Kσ l, σ r .
(3) We check that step3 Γ′′ (c̃) holds.
Let u ∼ v ∈ c̃. Since c̃ = Jc̃ ′ Kσ l, σ r , there exists u ′ ∼ v ′ ∈ c̃ ′ such that u = u ′σ l and v = v ′σ r .

′′

Since check_const({(c, Γ)}) = true, we know that u ′ and v ′ have the required form. Note that by deﬁnition of Γ , the keys which
′′
′′
are low in Γ , i.e. the keys k ∈ K such that there exist T such that Γ (k) = keyLL (T ), are exactly the keys which are low in Γ.
′
′
′
It clearly follows, by examining all cases for u and v , that u σ l and v ′σ r , i.e. u and v, also have the required form.
Therefore, step3 Γ′′ (c̃) holds.

(4) Finally, we check the condition step4Γ′′ (c̃).
Let M 1 ∼ N 1 ∈ c̃ and M 2 ∼ N 2 ∈ c̃. Since c̃ = Jc̃ ′ Kσ l, σ r , there exist M 1′ ∼ N 1′ ∈ c̃ ′ and M 2′ ∼ N 2′ ∈ c̃ ′ such that M 1 = M 1′ σ l, N 1 = N 1′σ r ,
M 2 = M 2′ σ l, and N 2 = N 2′σ r .
Let us prove the ﬁrst direction of the equivalence, i.e. the case where M 1 , M 2 are uniﬁable. The proof for the case where N 1 , N 2 are
uniﬁable is similar.
If M 1 , M 2 are uniﬁable, let µ be their most general uniﬁer. We have M 1 µ = M 2 µ, i.e. (M 1′ σ l)µ = (M 2′ σ l)µ.
Let τ denote the substitution σ lµ. Since M 1′ τ = M 2′ τ , M 1′ and M 2′ are uniﬁable. Let µ ′ be their most general uniﬁer. There exists θ
such that τ = µ ′θ.
′′
Let also α be the restriction of µ to {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ (x) = LL ∧ µ(x) ∈ N }.
′′
Note that Γ (x) = LL ⇔ Γ(x) = LL.
We have to prove that N 1α = N 2α.
′
l, ∞
Let x ∈ vars(M 1′ ) ∪ vars(M 2′ ) such that there exist m,p, l, l ′ such that Γ(x) = Jτm
; τpl , ∞ K, i.e. x ∈ F ′′ . By deﬁnition of σ l (point 1),
there exists i ∈ J1, nK such that xσ l = m i (and xσ r = pi ). Hence, we have

(xµ ′ )θ = xτ = xσ lµ = (xσ l)µ = m i µ = m i .

Thus, xµ ′ can only be either a variable y such that yθ = m i , or the nonce m i .
Therefore, µ ′ satisﬁes the conditions on the most general uniﬁer expressed in step4 Γ (c̃ ′ ).
′′

Let x ∈ vars(M 1 ) ∪ vars(M 2 ) such that Γ (x) = LL and µ(x) ∈ N . We have (xµ ′ )θ = xτ = xσ lµ = (xσ l)µ = xµ = µ(x) ∈ N . Thus,
xµ ′ can only be either a variable y (such that yθ = µ(x)), or the nonce µ(x).
Conversely, let x ∈ vars(M 1′ ) ∪ vars(M 2′ ) such that Γ(x) = LL and µ ′ (x) ∈ N . We have xµ = (xσ l)µ = xτ = (xµ ′ )θ = µ ′ (x).
′

l, ∞
Let then θ ′ be the substitution with domain {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | ∃m,p, l, l ′ .∃i ∈ J1, nK. Γ(x) = Jτm
; τpl , ∞ K ∧ µ ′ (x) = m i }
′
l, ∞
such that ∀x ∈ dom(θ ′ ). θ ′ (x) = pi if µ ′ (x) = m i and Γ(x) = Jτm
; τpl , ∞ K.

Let also α ′ be the restriction of µ ′ to {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | Γ(x) = LL ∧ µ ′ (x) ∈ N }.
Since check_const({(c, Γ)}) = true, we know that step4 Γ (c̃ ′) holds. Since M 1′ ∼ N 1′ ∈ c̃ ′ , and M 2′ ∼ N 2′ ∈ c̃ ′, this implies that
N 1′α ′θ ′ = N 2′α ′θ ′ .
As we have just shown, for all x ∈ dom(θ ′ ), there exists i ∈ J1, nK such that xσ l = m i and xσ r = pi , and µ ′ (x) is either m i or a
variable. By deﬁnition of dom(θ ′ ), only the case where µ ′ (x) = m i is actually possible, and we have θ ′ (x) = pi .
Thus, ∀x ∈ dom(θ ′ ). σ r (x) = θ ′ (x).
It then is clear from the deﬁnitions of the domains of θ ′ and σ r that there exists τ ′ such that σ r = θ ′τ ′ .
Thus, since we have shown that N 1′α ′θ ′ = N 2′α ′θ ′ , we have (N 1′α ′θ ′ )τ ′ = (N 2′α ′θ ′ )τ ′ , that is to say N 1′α ′σ r = N 2′α ′σ r , i.e., since α ′
and σ r have disjoint domains, and are both ground, N 1α ′ = N 2α ′ .
Moreover, we have shown that for all x ∈ vars(M 1′ ) ∪ vars(M 2′ ) such that Γ(x) = LL and µ ′ (x) ∈ N , µ(x) = µ ′ (x). That is to say that
for all x ∈ dom(α ′ ), µ(x) = α ′ (x).
In addition, it is clear from the deﬁnition of σ l that
′′

{x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | Γ(x) = LL} = {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ (x) = LL}.

Hence
′′

dom(α) = {x ∈ vars(M 1 ) ∪ vars(M 2 ) | Γ (x) = LL ∧ µ(x) ∈ N }
= {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | Γ(x) = LL ∧ µ(x) ∈ N }
⊇ {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | Γ(x) = LL ∧ µ(x) ∈ N ∧ µ ′ (x) ∈ N }
= {x ∈ vars(M 1′ ) ∪ vars(M 2′ ) | Γ(x) = LL ∧ µ ′ (x) ∈ N }
= dom(α ′ ).
Therefore, ∀x ∈ dom(α ′ ). x ∈ dom(α) ∧ α ′ (x) = α(x). Thus there exists α ′′ such that α = α ′α ′′ .
Since we already have N 1α ′ = N 2α ′ , this implies that N 1α = N 2α, which concludes the proof that step4 Γ′′ (c̃) holds. Hence,
check_const({(c, Γ ′′ )}) = true.


We can now prove the following theorem:
Theorem B.55. Let C, and C ′ be two constraint sets without any common variable.
 
 n
check_const([ C ]1 ∪× [ C ]2 ∪× C ′ 1 ) = true ⇒ ∀n. C ′ 1 ∪× (∪×1≤i ≤n [ C ]ni ) is consistent.

Proof. Assume check_const([ C ]1 ∪× [ C ]2 ∪× [ C ′ ]1 ) = true. Let n > 0. Let us show that [ C ′ ]n1 ∪× (∪×1≤i ≤n [ C ]ni ) is consistent.
By Theorem B.52, it suﬃces to show that check_const([ C ′ ]n1 ∪× (∪×1≤i ≤n [ C ]ni )) = true.
By Theorem B.53, it suﬃces to show that check_const([ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 ) = true.
By assumption, we know that check_const([ C ]1 ∪× [ C ]2 ∪× [ C ′ ]1 ) = true.
That is to say, for each (c 1 , Γ1 ) ∈ C, (c 2 , Γ2 ) ∈ C, (c 3 , Γ3 ) ∈ C ′, if c ′ = [ c 1 ]1Γ1 ∪ [ c 2 ]2Γ2 ∪ [ c 3 ]1Γ3 , and Γ ′ = [ Γ1 ]1 ∪ [ Γ2 ]2 ∪ [ Γ3 ]1 ,
check_const({(c ′, Γ ′ )}) = true.
Thus, by Lemma B.54, for all (c 1 , Γ1 ) ∈ C, (c 2 , Γ2 ) ∈ C, (c 3 , Γ3 ) ∈ C ′, if c ′ = [ c 1 ]1Γ1 ∪ [ c 2 ]2Γ2 ∪ [ c 3 ]1Γ3 , and Γ ′ = [ Γ1 ]n1 ∪ [ Γ2 ]n2 ∪ [ Γ3 ]n1 ,
check_const({(c ′, Γ ′ )}) = true.
That is to say, check_const([ C ]n1 ∪× [ C ]n2 ∪× [ C ′ ]n1 ) = true, which concludes the proof.


