SAPIC+ Symbolic Verifier: Framework Overview

• SAPIC+ Symbolic Verifier is a formal framework that extends applied π-calculus by incorporating mutable global state and explicit concurrency primitives.
• It integrates cryptographic primitives with database-style state operations, enabling mechanized proofs of security properties in protocols such as DNSSEC.
• The verifier bridges symbolic and computational models through CoSP embeddings, ensuring rigorous, automated analysis of stateful security protocols.

The SAPIC⁺ symbolic verifier is a formal modeling and verification framework that extends the applied π-calculus with explicit support for mutable, global state and concurrency control, enabling the analysis of stateful security protocols and systems. Its theoretical foundations ensure computational soundness, and its implementation underlies large-scale automated protocol analyses such as DNSSECVerif. The system supports encoding protocol-level interactions, cryptographic primitives, database-style state operations, and precise adversarial models, providing mechanized proofs of critical protocol invariants and security properties (Shao et al., 2016, Zhang et al., 12 Dec 2025).

1. Foundations: SAPIC⁺ Process Calculus

The SAPIC⁺ process calculus augments the standard applied π-calculus to include global mutable storage—namely, a “functional” store mapping cells to values and a multiset store of facts—and explicit concurrency primitives.

Abstract Syntax

Terms and processes in SAPIC⁺ are syntactically defined as follows:

$$\begin{array}{rcll} \text{Terms: } M,N &::=& a \mid x \mid f(M_1,\dots,M_n) & \text{(names, variables, constructors)}\ \text{Processes: } P,Q &::=& 0 & \text{(nil)} \ &\mid& P\;\|\;Q & \text{(parallel)} \ &\mid& !P & \text{(replication)} \ &\mid& \nu a.P & \text{(name restriction)} \ &\mid& \mathsf{out}(c, M); P & \text{(output)} \ &\mid& \mathsf{in}(c, (x_1,\dots,x_k)); P & \text{(input)} \ &\mid& \mathsf{if}~M=N~\mathsf{then}~P~\mathsf{else}~Q & \text{(conditional)} \ &\mid& \mathsf{let}~x = f(M_1,\dots,M_n)~\mathsf{in}~P & \text{(destructor binding)} \ &\mid& \mathsf{insert}~M~\mathsf{into}~T;P & \text{(state insert)} \ &\mid& \mathsf{delete}~M~\mathsf{from}~T;P & \text{(state delete)} \ &\mid& \mathsf{lookup}~M~\mathsf{as}~x~\mathsf{in}~T~\mathsf{then}~P~\mathsf{else}~Q & \text{(state lookup)} \ &\mid& \mathsf{lock}~\ell;P~|~\mathsf{unlock}~\ell;P & \text{(concurrency primitives)} \end{array}$$

Here, storage tables $T$ and locks $\ell$ are explicit entities, and concurrency primitives enable accurate modeling of shared-memory behavior and atomicity (Zhang et al., 12 Dec 2025).

Equational Theory

SAPIC⁺ is parameterized by an equational theory $E$, supporting various cryptographic constructs. For example, in DNSSEC, constructors like $\mathsf{sign}$, $\mathsf{verify}$, $\mathsf{pk}$, $\mathsf{sk}$, $\mathsf{hash}$, and $\mathsf{pair}$ are paired with defining equations, e.g.,

$$\mathsf{verify}(\mathsf{sign}(m,k), m, \mathsf{pk}(k)) = \mathsf{true}$$

providing an idealized cryptographic abstraction that enables automation (Zhang et al., 12 Dec 2025).

2. Operational Semantics and State Manipulation

SAPIC⁺ employs a small-step operational semantics on configurations combining process multisets, state tables, and locks.

State and Concurrency

State operations correspond directly to database-style update and query primitives:

• $\mathsf{insert}~M~\mathsf{into}~T;P$ adds $M$ to table $T$, proceeding as $P$.
• $\mathsf{delete}~M~\mathsf{from}~T;P$ removes $M$ from $T$.
• $$\mathsf{lookup}~M~\mathsf{as}~x~\mathsf{in}~T~\mathsf{then}~P~\mathsf{else}~Q$$ selects between $P$ (on hit) and $Q$ (on miss).
• $\mathsf{lock}~\ell;P$ and $\mathsf{unlock}~\ell;P$ provide mutual exclusion over resources, enabling atomicity for compound state operations.

Sample inference rules describe communication, state, and lock transitions:

$$\frac{}{\bigl(\mathsf{out}(c, M);P~\|~\mathsf{in}(c, (x));Q, T\bigr) \to (P~\|~Q\{M/x\}, T)}$$

$$\frac{}{(\mathsf{insert}~M~\mathsf{into}~T;P, T') \to (P, T' \cup \{M\})}$$

$$\frac{\ell \notin \mathsf{Locked}}{(\mathsf{lock}~\ell;P~\|~\dots, \mathsf{Locked}) \to (P~\|~\dots, \mathsf{Locked} \cup \{\ell\})}$$

Locks ensure precise modeling of race conditions and concurrency bugs in protocol-level caches and stores (Zhang et al., 12 Dec 2025).

Configuration Structure

A ground SAPIC configuration is given by $$(\tilde{n}, S, S^{MS}, \mathcal{P}, \mathcal{K}, \mathcal{L})$$, where:

• $\tilde{n}$: Set of restricted (fresh) names
• $S$: Partial function for “functional” state
• $S^{MS}$: Multiset of ground facts
• $\mathcal{P}$: Multiset of running processes
• $\mathcal{K}$: Adversary’s knowledge
• $\mathcal{L}$: Locked cells (Shao et al., 2016)

3. Symbolic Model, Adversary, and Security Specification

Communication in SAPIC⁺ is governed by the Dolev–Yao adversary model: every message on a public channel is observable and forgeable by the adversary, whose knowledge is closed under the equational theory $E$.

Symbolic Execution

Symbolic execution manipulates terms constructed from the protocol specification, enabling exhaustive, over-approximate exploration of possible traces.

Security Properties

Trace properties are expressed by event facts and first-order formulas over event traces. SAPIC⁺ defines a trace property $\mathcal{W}$ as any prefix-closed, polytime-decidable set of event sequences. For example:

• Data Origin Authentication

$$\forall D.~~\mathsf{Accepted}(D) \implies \exists Z, \sigma.~\mathsf{Owns}(Z, D) \wedge \mathsf{IssuedSig}(Z, D, \sigma)$$

• Denial of Existence (NSEC/NSEC3) Soundness

$\forall s, r, q, m~\#i.~~\mathsf{ResolverReceiveResult}(s,r,q,m)@#i \implies \exists~\#j, \mathrm{sig}.~\mathsf{ServerSendResp}(s,r,q,m)@\#j \wedge \#j < \#i \wedge \cdots$

Specification through events and reachability (e.g., the non-occurrence of an $\mathsf{Attack}$ event) enables correlation with tool-specific assertion languages (e.g., Tamarin, ProVerif) (Zhang et al., 12 Dec 2025).

4. Computational Soundness and the CoSP Embedding

The SAPIC⁺ framework rigorously connects symbolic analysis to computational cryptography through the CoSP (Computational Soundness Proofs) abstraction.

CoSP Protocols and Embedding

The CoSP protocol is a finite tree of node types (computation, destructor, input, output, control). SAPIC⁺ embeddings serialize protocol states, including non-monotonic stores, into CoSP node identifiers. Crucial sub-protocols include:

• $f_{\mathsf{mem}}$: Implements state membership/retrieval with polytime complexity.
• $f_{\mathsf{match}}$: Provides multiset fact-pattern matching for rewrite rules.

With these embeddings, each SAPIC⁺ process yields a CoSP protocol $\Pi^S_{P_0}$ that is efficient (poly-size node identifiers and polytime reductions) and accurately approximates SAPIC⁺ reductions (Shao et al., 2016).

Soundness Theorems

Key results formally tie symbolic SAPIC⁺ executions to the computational model:

• Theorem 1 (SAPIC Computational Soundness): For any computational implementation $A$ of the symbolic model sound for a class of CoSP protocols $P$, if a SAPIC⁺ process $P_0$ symbolically satisfies a trace property $\mathcal{W}$, and $\Pi^S_{P_0} \in P$, then $P_0$ computationally satisfies $\mathcal{W}$.
• Theorem 3: For public-key encryption and signatures realized under suitable cryptographic assumptions, every “randomness-safe” closed SAPIC⁺ process that symbolically satisfies $\mathcal{W}$ also computationally satisfies $\mathcal{W}$ (Shao et al., 2016).

These results ensure that machine-checked symbolic proofs deliver guarantees valid for cryptographically faithful protocol implementations.

5. Toolchain and Automated Verification

SAPIC⁺ specifications are automatically compiled into input formats for leading protocol analyzers.

Back-End Integration

• Tamarin: Used for fine-grained trace-based proofs and invariant checking, especially for stateful and concurrency-rich protocols.
• ProVerif: Applied when large state spaces benefit from Horn-clause abstraction, serving as a fallback when Tamarin’s symbolic execution tree expansion is intractable.

Soundness results guarantee the transferability of proofs across back-ends (Zhang et al., 12 Dec 2025).

Proof Strategy

• Each security goal is formalized as a lemma over event traces.
• Tamarin constructs a symbolic execution tree, proving the lemma by rule induction.
• For complex invariants, bisimulations between SAPIC⁺’s global state and abstract models are constructed, and rule induction validates invariant preservation through all protocol reductions.

This architecture supports compositional reasoning and systematic coverage of trace properties involving stateful protocol actions.

6. Concrete Applications and Example Protocol Models

The SAPIC⁺ symbolic verifier has been deployed in substantial protocol models, notably DNSSECVerif.

DNSSEC Modeling

SAPIC⁺ models roles (clients, authoritative servers, resolvers) as parameterized processes with shared state, locks, and event generation. Example fragments illustrate:

let Resolver(r_chan_c_resol, r_chan_root) =
  new cache_root;
  !(
    in(r_chan_c_resol, <qname,qtype>);
    lock cache_root;
    lookup (<qname,qtype>) as e in cache_root
      then   event RootCacheValid(e); unlock cache_root
      else   out(r_chan_root, <qname,qtype>);
             in(r_chan_root, <rname, rtype, rdata>);
             let resp= <rname,rtype,rdata> in
             insert resp into cache_root;
             event RootCacheInsert(resp);
             unlock cache_root
    // … iterative resolution and checks …
  ).

• Processes model DNS clients, authoritative nameservers, and resolvers with explicit state operations and locking for cache management.
• Cryptographic operations ($\mathsf{sign}, \mathsf{verify}$) and stateful table lookups directly capture protocol security mechanisms.
• Trace properties established in SAPIC⁺ are mechanically verified against known and emergent attack classes, and formal invariants correspond to DNSSEC's data origin, integrity, authenticated denial of existence, and stateful cache correctness.

Exhaustive analyses in DNSSECVerif have proven core security claims and rediscovered classes of DNS-level attacks, linking formal verification with empirical vulnerability testing in real-world deployments (Zhang et al., 12 Dec 2025).

---

The SAPIC⁺ symbolic verifier thus provides a rigorous foundation and automated workflow for stateful protocol analysis, bridging symbolic abstraction and computational cryptography via sound embeddings, and supporting evidence-based verification of security-critical distributed systems.