(* Needham Shroeder public-key protocol
   Corrected version of Lowe *)

pred c/1 elimVar,decompData.
nounif c:x.

fun pk/1.
fun encrypt/2.

query c:secret[].

reduc
(* Initialization *)

c:c[];
c:pk(sA[]);
c:pk(sB[]);

(* The attacker *)

c:x & c:encrypt(m,pk(x)) -> c:m;
c:x -> c:pk(x);
c:x & c:y -> c:encrypt(x,y);

(* The protocol *)
(* A *)

c:pk(x) -> c:encrypt((Na[pk(x)], pk(sA[])), pk(x));
c:pk(x) & c:encrypt((Na[pk(x)], y, pk(x)), pk(sA[]))
   -> c:encrypt((y,k[pk(x)]), pk(x));

(* B *)

c:encrypt((x,y), pk(sB[])) -> c:encrypt((x, Nb[x,y], pk(sB[])), y);
c:encrypt((x,pk(sA[])), pk(sB[])) & c:encrypt((Nb[x, pk(sA[])], z), pk(sB[]))
   -> c:encrypt(secret[], pk(z)).

(* EXPECTPV
RESULT goal unreachable: c:secret[]
0.008s (user 0.008s + system 0.000s), max rss 8428K
END *)
