free c:channel.
free s:bitstring [private].

fun enc(bitstring,bitstring):bitstring.
reduc forall x:bitstring,y:bitstring; dec(enc(x,y),y) = x.

event UAction(bitstring,bitstring).

axiom st:bitstring, x:bitstring, y:bitstring;
  event(UAction(st,x)) && event(UAction(st,y)) ==> x = y.

query attacker(s).

process
  new k:bitstring;
  new k1:bitstring;
  new k2:bitstring;
  out(c,enc(k1,k));
  out(c,enc(k2,k));
  out(c,enc(s,(k1,k2)));
  in(c,y:bitstring);
  new st[]:bitstring;
  event UAction(st,y);
  out(c,dec(y,k))

(* EXPECTPV
RESULT not attacker(s[]) is true.
0.008s (user 0.000s + system 0.008s), max rss 7616K
END *)
