Relating Two Standard Notions of Secrecy

Two styles of definitions are usually considered to express that a security protocol preserves the confidentiality of a data s. Reachability-based secrecy means that sshould never be disclosed while equivalence-based secrecy states that two executions of a protocol with distinct instances for s should be indistinguishable to an attacker. Althoughthe second formulation ensures a higher level of security and is closer to cryptographic notions of secrecy, decidability results and automatic tools have mainly focused on the first definition so far.This paper initiates a systematic investigation of the situations where syntactic se-crecy entails strong secrecy. We show that in the passive case, reachability-based secrecy actually implies equivalence-based secrecy for digital signatures, symmetric and asymmet-ric encryption provided that the primitives are probabilistic. For active adversaries, weprovide sufficient (and rather tight) conditions on the protocol for this implication to hold.