type spkey.
type sskey.
type skey.
type pkey.
type key.

fun spk(sskey) : spkey.
fun pk(skey) : pkey.
fun aenc(bitstring, pkey) : bitstring.
fun senc(bitstring, key) : bitstring.
fun sign(bitstring, sskey) : bitstring.

reduc forall m : bitstring, sk : skey; adec(aenc(m, pk(sk)), sk) = m.
reduc forall m : bitstring, k : key; sdec(senc(m, k), k) = m.
reduc forall m : bitstring, sk : sskey; checksign(sign(m, sk), spk(sk)) = m.

channel c.

free s : bitstring [private].


query secret nonceB.

let initiatorA(pkB : spkey) =
  new nonceA : bitstring;
  out(c, nonceA);
  in(c, m : bitstring);
  let (=pkB, =nonceA, nonceB : bitstring) = checksign(m, pkB) in
  out(c, nonceB).

let responderB(skB : sskey) =
  in(c, nonceX : bitstring);
  new nonceB : bitstring;
  out(c, sign((spk(skB), nonceX, nonceB), skB));
  in(c, =nonceB).

process
  new skB : sskey;
  initiatorA(spk(skB)) | responderB(skB)

(* EXPECTPV
RESULT secret nonceB_1,nonceB is false.
0.004s (user 0.004s + system 0.000s), max rss 8284K
END *)
