Appears in Information Processing Letters, Volume 86, Number 6.
June, 2003.
Pages 329–333.

Some formal methods for cryptographic protocol analysis represent message fields using a free term algebra, which does not permit an explicit symmetric decryption operator. Although the ability of principals and intruders to decrypt encrypted messages is represented implicitly, such models can fail to recognize some attacks. However, with an additional restriction on the protocol -- EV-freedom, in which encrypted message fields must have a known structure -- the extension of the free algebra with decryption is unnecessary because it does not enable any new attacks. The analogous question for public key encryption is open.

@Article{Mil03,
    AUTHOR = {{J.} Millen},
    TITLE = {On the freedom of decryption},
    JOURNAL = {Information Processing Letters},
    VOLUME = {86},
    NUMBER = {6},
    YEAR = {2003},
    PAGES = {329-333},
    MONTH = {June},
    URL = {http://www.csl.sri.com/papers/free/}
}

• free.ps