Sufficient and necessary causation are dual

Causation has been the issue of philosophic debate since Hippocrates. Recent work defines actual causation in terms of Pearl/Halpern’s causality framework, formalizing necessary causes (IJCAI’15). This has inspired causality notions in the security domain (CSF’15), which, perhaps surprisingly, formalize sufficient causes instead. We provide an explicit relation between necessary and sufficient causes. Notation Let N be the set of natural numbers and assume that they begin at 0. rrv ÞÑ vals :“ przpv, rpvqqq Y pv, valq is short-hand for the function mapping v to val and otherwise behaving like r. We write ~t for a sequence t1, . . . , tn if n is clear from the context and denote the ith element with ~t|i. We use ~a ̈~b to denote concatenation of vectors ~a and ~b. We filter a sequence l by a set S, denoted l|S , by removing each element that is not in S. 1 Causal model (Review) We review the causal framework introduced by Pearl and Halpern [Pearl, 2000; Halpern, 2015], also known as the structural equations model, which provides the notion of causality which we will investigate for the case of security protocols. The causality framework models how random variables influence each other. The set of random variables is partitioned into a set U of exogenous variables, variables that are outside the model, e.g., in the case of a security protocol, the attack the adversary decides to mount, and a set V of endogenous variables, which are ultimately determined by the value of the exogenous variables. We call the triple consisting of U , V and function R associating a range to each variable Y P U Y V a signature. A causal model on this signature defines the relation between endogenous variables and exogenous variables or other endogenous variables in terms of a set of functions. Definition 1 (Causal model). A causal model M over a signature S “ pU ,V,Rq is a pair of said signature S and a set of functions F “ tFX uXPV such that, for each X P V,