### Table 3 The Kerberos Protocol in spi-calculus

"... In PAGE 6: ... For example a(hy;zi):P stands for a(x):pair x of hy;zi in P, a(fMgk):P stands for a(x):casexof fygk in[y = M]P, and a(fM;Ngk):P stands for a(x):casexof fygk in pair y of hz;ti in [z = M;t = N]P. Table3 gives a high level specification of the protocol us- ing these abbreviations, while Table 4 gives its translation into the syntax of Table 1. All bound names in K are as- sumed to be distinct from one another and from free names.... ..."

### Table 3 Syntax of messages, expressions and formulae for the spi-calculus

"... In PAGE 4: ... In order to unify the presentation of the pi-calculus and the spi-calculus, we have parametrised the syntax of processes Table 1 by messages, expressions and formulae. Table 2 read in conjunction with Table 1 gives the syntax of the pi-calculus, whereas for the spi-calculus, Table3 and Table 1 should be considered. The set of names appearing in a message M is written n(M).... In PAGE 16: ....1.1 Syntax and semantics The spi-calculus is a process calculus that was introduced by Abadi and Gor- don [AG99] to model and study cryptographic protocols. The syntax of the spi-calculus is given by Table 1 and Table3 . We have chosen to focus the study of this paper to a shared-key cryptosystem but the... ..."

### Table 3 Syntax of messages, expressions and formulae for the spi-calculus

"... In PAGE 96: ... In order to unify the presentation of the pi-calculus and the spi-calculus, we have parametrised the syntax of processes Table 1 by messages, expressions and formulae. Table 2 read in conjunction with Table 1 gives the syntax of the pi-calculus, whereas for the spi-calculus, Table3 and Table 1 should be considered. The set of names appearing in a message M is written n(M).... ..."

### Table 4 Encoding of the spi calculus

2003

"... In PAGE 10: ... The basic idea of the encoding is to represent an encrypted message with a sealed ambient that contains that message: communicating the encrypted message is then accounted for by communicating the name of the corresponding ambient. The formal de nition is given in Table4 in terms of three translation maps: h ip : Expressions 7! Expressions, [[ ]] p : Expressions 7! Processes, and [[ ]] : Processes 7! Processes. In the rst two (subsidiary) maps, p is the name of the ambient (if any) enclosing the message to be ex- changed.... ..."

Cited by 4

### Table 4 Encoding of the spi calculus

2003

"... In PAGE 10: ... The basic idea of the encoding is to represent an encrypted message with a sealed ambient that contains that message: communicating the encrypted message is then accounted for by communicating the name of the corresponding ambient. The formal definition is given in Table4 in terms of three translation maps: CWCWA1CXCXp : Expressions BJAX Expressions, CJCJA1CLCL p : Expressions BJAX Processes, and CJCJA1CLCL : Processes BJAX Processes. In the first two (subsidiary) maps, p is the name of the ambient (if any) enclosing the message to be exchanged.... ..."

Cited by 4

### Table 2 Simple Protocol in r-spi calculus

"... In PAGE 3: ... (we implement signature by encrypting with the private key.) A ! B : fB;mgPriv(kA) The narration of the protocol in r-spi is reported in Table2 ; after declaring the key pair for A, an unbounded number of instances of A as initiator and an unbounded number of instances of B as responder are run in parallel. The Initiator generates a new mes- sage m, declares the start of the session with the responder, signs m together with the responder identi er and sends the obtained ci- phertext on the network.... ..."

### Table 4 The commitment semantics of the spi-calculus

2002

Cited by 9

### Table 6 Variant of CCITT X.509 (3) in r-spi calculus

2005

"... In PAGE 6: ... Although our current analysis cannot deal with secrecy (this is part of the ongoing work), we analyzed the authentication guarantees provided by the protocol. The code of the protocol is in Table6 . We analyze an unbounded number of instances of A and B playing both the initiator and the responder roles.... ..."

Cited by 1

### Table 7 Amended SPLICE/AS Protocol in r-spi calculus

"... In PAGE 8: ... In the second ciphertext, B sends back the nonce thus no tag is needed. The r-spi calcu- lus speci cation of the protocol is reported in Table7 : notice that we analyze an unbounded number of sessions, where A and B play both the initiator and the responder role. To check mutual au- thentication, we alternatively decorate the protocol with two dif- ferent pairs of correspondence primitives run1(I;J);commit1(J;I) and run2(I;J);commit2(J;I).... ..."