(* Handshake protocol.
   From Delaune, Jacquemard, CSFW'04
*)

type passwd.
type nonce.

(* shared-key encryption as equation *)

fun encrypt(nonce, passwd): nonce.
fun decrypt(nonce, passwd): nonce.
equation forall x: nonce, y: passwd; decrypt(encrypt(x,y),y) = x.
equation forall x: nonce, y: passwd; encrypt(decrypt(x,y),y) = x.

(* addition of one *)

fun incr(nonce): nonce.

free c: channel.
free d: channel [private].
free pw: passwd [private].
weaksecret pw.

let processA = 
	new N: nonce;
	out(c, encrypt(N, pw)).

let processB = 
	in(c, x: nonce);
	out(d, x).

let processC =
        in(d, x: nonce);
	let n = decrypt(x, pw) in
	out(c, encrypt(incr(n), pw)).
    
process
	(!processA)
	|
	(!processB)
	|
	(!processC)

(* EXPECTPV
RESULT Weak secret pw is false.
0.028s (user 0.024s + system 0.004s), max rss 9060K
END *)
