Summary: The correctness of an authentication protocol is based on, among other things, the relation between nonces and data that is established in the course of execution of the protocol. In this paper, we formulate an inference system that derives the secrecy of nonces and the relation that binds nonces and data. It is easy to show the correctness of a protocol by directly deriving the binding relation using the inference rules. Depending on situations, it is also possible to extend the inference system by simply adding new inference rules. We give some example protocols whose correctness can only be shown using some conditions on nonces that are formulated as additional inference rules.
For the entire collection see [Zbl 1017.00039].