(* When there is an event and ProVerif tries to simplify
   the process, there was an internal error.
   This bug is now fixed.

   Private Authentication
   Taken from Delaune, Jacquemard, CSFW'04 *)

(* set simplifyProcess = interactive. *)

event eA.

(* shared-key encryption as equation *)

fun aenc(bitstring, bitstring): bitstring.
fun pk(bitstring): bitstring.

reduc forall x: bitstring, y: bitstring; adec(aenc(x,pk(y)),y) = x.

(* declaration of public name*)

free c: channel.

(* declaration of biprocess *)

let processA(sk_a:bitstring,sk_b:bitstring) =
	new n_a: bitstring;
	event eA;
	out(c, aenc((n_a,pk(sk_a)),pk(sk_b)));
	in(c, x:bitstring);
	0.

let processB(sk_b:bitstring,sk_a:bitstring) =
	in(c, x:bitstring);
	new n_b:bitstring;

	let (n_a:bitstring,pub_a:bitstring) = adec(x, sk_b) in
	  if pub_a = pk(sk_a)
	  then
	    out(c,aenc((n_a,n_b,pk(sk_b)),pk(sk_a)))
	  else
	    out(c,aenc(n_b,pk(sk_b)))
	else
	  out(c,aenc(n_b,pk(sk_b))).
	  
let system(sk_a:bitstring,sk_b:bitstring) = !processA(sk_a,sk_b) | !processB(sk_b,sk_a).

process
	new sk_a:bitstring; new sk_b:bitstring; new sk_c:bitstring;
	  !out(c,pk(sk_a));out(c,pk(sk_b));out(c,pk(sk_c));
	  system(choice[sk_a,sk_c],sk_b)

(* EXPECTPV
RESULT Observational equivalence cannot be proved.
RESULT Observational equivalence is true.
0.072s (user 0.068s + system 0.004s), max rss 9272K
END *)
