Deconstructing Alice and Bob

We show that, despite the fact that Alice&Bob;–notation does not include explicit control flowconstructs, it is possible to make some of these aspects explicit and thus produce formal protocolmodels without having to resort to more expressive protocol description languages. We introducea notion of incremental symbolic runs to formally handle message forwarding and conditionalabortion. In these runs, we use variables to represent messages that the principals cannot read, andwe characterize each of the execution steps in order to build a collection of “symbolic subruns” ofincreasing lengths, reflecting the data possessed by the principals up to that point in the execution.We contrast this with the simpler (more standard) approach based on formalizing the behavior ofprincipals by directly interpreting message exchanges as sequences of atomic actions. In particular,we provide a complete characterization of the situations where this simpler approach is adequateand prove that incremental symbolic runs are more expressive in general.