free c:channel.

fun h(bitstring):bitstring.

const a,b:bitstring.

event A(bitstring).

const ok,ko:bitstring.

fun enc(bitstring,bitstring):bitstring.
fun dec(bitstring,bitstring):bitstring.
equation forall x:bitstring, y:bitstring; dec(enc(x,y),y) = y.

axiom x:bitstring,y:bitstring; event(A(enc(x,y))) ==> event(A(dec(x,y))).

axiom x:bitstring,y:bitstring,z:bitstring; event(A(enc(x,enc(y,z)))) ==> event(A(dec(x,y))) && x<>z.

axiom x:bitstring,y:bitstring; event(A(enc(x,y))) ==> event(A(dec(x,y))) && x<>y.

axiom x:bitstring,y:bitstring,z:bitstring; event(A(enc(x,enc(y,z)))) ==> event(A(dec(x,y))) && x<>dec(y,z).

lemma x:bitstring,y:bitstring; event(A(x)) && attacker(a) phase 1 ==> x=a [maxSubset].


query x:bitstring; event(A(x)).

process
  in(c,x:bitstring);
  phase 1;
  if x = a
  then
    event A(a);
    phase 2;
    out(c,ok)
  else
    out(c,dec(x,ko))

(* EXPECTPV
RESULT event(A(x_1)) && attacker_p1(a) ==> x_1 = a is true.
RESULT not event(A(x_1)) is false.
0.028s (user 0.012s + system 0.016s), max rss 8688K
END *)
