free c:channel.
free s:bitstring [private].

fun enc(bitstring,bitstring):bitstring.
reduc forall x:bitstring,y:bitstring; dec(enc(x,y),y) = x.

process
  new k:bitstring;
  new k1:bitstring;
  new k2:bitstring;
  out(c,enc(k1,k));
  out(c,enc(k2,k));
  out(c,choice[enc(s,(k1,k2)),s]);
  in(c,y:bitstring) [precise];
  out(c,dec(y,k))

(* EXPECTPV
RESULT Observational equivalence is true.
0.028s (user 0.016s + system 0.012s), max rss 8732K
END *)
