(* SKEME *)

pred c/1 decompData, elimVar.

(* Public key cryptography *)

fun pk/1.
fun encrypt/2.

(* Hash function *)

fun hash/1.

(* Diffie-Hellman *)
(* equation f(x,g(y)) = f(y,g(x)). *)

fun g/1.
fun h1/2.
fun h0/2.

(* Keyed hash function *)

fun keyhash/2.

query c:secretA[].
query c:secretB[].

(* Secrecy assumptions *)

not c:skA[].
not c:x[pk(skA[])].
not c:y[(encrypt((pk(skA[]), a), pk(skA[])), b)].
not c:Ka[pk(skA[])].
not c:Kb[(encrypt((pk(skA[]),Ka[pk(skA[])]),pk(skA[])),g(x[pk(skA[])]))].

reduc

c:keyhash((g(y[(encrypt((pk(skA[]),v18),pk(skA[])),v19)]),v19,pk(skA[]),pk(skA[])),hash((v18,Kb[(encrypt((pk(skA[]),v18),pk(skA[])),v19)]))) & c:(encrypt((pk(skA[]),v18),pk(skA[])),v19) -> c:encrypt(secretB[],pk(hash(h0(y[(encrypt((pk(skA[]),v18),pk(skA[])),v19)],v19))));
c:keyhash((g(y[(encrypt((pk(skA[]),v16),pk(skA[])),g(v17))]),g(v17),pk(skA[]),pk(skA[])),hash((v16,Kb[(encrypt((pk(skA[]),v16),pk(skA[])),g(v17))]))) & c:(encrypt((pk(skA[]),v16),pk(skA[])),g(v17)) -> c:encrypt(secretB[],pk(hash(h1(y[(encrypt((pk(skA[]),v16),pk(skA[])),g(v17))],v17))));
c:keyhash((g(y[(encrypt((pk(skA[]),v15),pk(skA[])),g(v14))]),g(v14),pk(skA[]),pk(skA[])),hash((v15,Kb[(encrypt((pk(skA[]),v15),pk(skA[])),g(v14))]))) & c:(encrypt((pk(skA[]),v15),pk(skA[])),g(v14)) -> c:encrypt(secretB[],pk(hash(h1(v14,y[(encrypt((pk(skA[]),v15),pk(skA[])),g(v14))]))));
c:(encrypt((v11,v12),pk(skA[])),v13) -> c:(encrypt(Kb[(encrypt((v11,v12),pk(skA[])),v13)],v11),g(y[(encrypt((v11,v12),pk(skA[])),v13)]),keyhash((v13,g(y[(encrypt((v11,v12),pk(skA[])),v13)]),pk(skA[]),v11),hash((v12,Kb[(encrypt((v11,v12),pk(skA[])),v13)]))));
c:(encrypt(v10,pk(skA[])),v9,keyhash((g(x[pk(skA[])]),v9,pk(skA[]),pk(skA[])),hash((Ka[pk(skA[])],v10)))) & c:pk(skA[]) -> c:encrypt(secretA[],pk(hash(h0(x[pk(skA[])],v9))));
c:(encrypt(v8,pk(skA[])),g(v7),keyhash((g(x[pk(skA[])]),g(v7),pk(skA[]),pk(skA[])),hash((Ka[pk(skA[])],v8)))) & c:pk(skA[]) -> c:encrypt(secretA[],pk(hash(h1(x[pk(skA[])],v7))));
c:(encrypt(v6,pk(skA[])),g(v5),keyhash((g(x[pk(skA[])]),g(v5),pk(skA[]),pk(skA[])),hash((Ka[pk(skA[])],v6)))) & c:pk(skA[]) -> c:encrypt(secretA[],pk(hash(h1(v5,x[pk(skA[])]))));
c:(encrypt(v4,pk(skA[])),v2,keyhash((g(x[v3]),v2,v3,pk(skA[])),hash((Ka[v3],v4)))) & c:v3 -> c:keyhash((v2,g(x[v3]),pk(skA[]),v3),hash((Ka[v3],v4)));
c:v1 -> c:(encrypt((pk(skA[]),Ka[v1]),v1),g(x[v1]));
c:pk(skA[]);
c:c[];
c:encrypt(x,pk(y)) & c:y -> c:x;
c:any11 -> c:pk(any11);
c:any10 & c:any9 -> c:keyhash(any10,any9);
c:any8 & c:any7 -> c:encrypt(any8,any7);
c:any6 & c:any5 -> c:h1(any6,any5);
c:any4 & c:any3 -> c:h0(any4,any3);
c:any2 -> c:hash(any2);
c:any1 -> c:g(any1);
c:x & c:y -> c:h0(x,y);
c:x & c:g(y) -> c:h1(x,y);
c:y & c:g(x) -> c:h1(x,y);
c:x & c:h1(x,y) -> c:g(y);
c:x & c:h1(y,x) -> c:g(y).

(* EXPECTPV
RESULT goal unreachable: c:secretB[]
RESULT goal unreachable: c:secretA[]
0.016s (user 0.012s + system 0.004s), max rss 8944K
END *)
