(* Denning-Sacco *)

free c.

(* Probabilistic public key cryptography *)

fun pk/1.
fun encrypt/3.
reduc decrypt(encrypt(x,pk(y),r),y) = x.

(* Signatures *)

fun sign/2.
reduc getmess(sign(m,k)) = m.
reduc checksign(sign(m,k), pk(k)) = m.

(* Probabilistic Shared-key cryptography *)

fun sencrypt/3.
reduc sdecrypt(sencrypt(x,y,r),y) = x.

data secrcst/0.

(* Secrecy assumptions *)

not skA.
not skB.

data ok/0.
data error/0.
free n2.

private free secretA1, secretA2, secretB.
noninterf secretA1 among (ok, n2), secretA2 among (error, n2).

let processA =
	in(c, pk2);
	new k; new r;
	out(c, (encrypt(sign((pkA, pk2, k), skA), pk2, r)));
	if pk2 = pkB then
	in(c, m);
        let (=secrcst, s) = sdecrypt(m,k) in 
 	(
	new r2;
	out(c, sencrypt(secretA1, k, r2)) (* secretA1 takes values "ok" or n2 *)
	)
	else
	(
	new r3;
	out(c, sencrypt(secretA2, k, r3)) (* secretA2 takes values "error" or n2 *)
	).

let processB =
	in(c, km);
	let ks = decrypt(km,skB) in
	let (=pkA, =pkB, k) = checksign(ks, pkA) in
	new r;
	out(c, sencrypt((secrcst, secretB), k, r)).

process new skA; 
	let pkA = pk(skA) in
        out(c, pkA);
        new skB; 
	let pkB = pk(skB) in
        out(c, pkB);
	((!processA) | (!processB))

(* EXPECTPV
RESULT Non-interference secretA1 among (ok(), n2[]), secretA2 among (error(), n2[]) is true.
0.032s (user 0.024s + system 0.008s), max rss 8820K
END *)
