set allowDiffPatterns = true.

(********   This file has been automatically generated using the tool UKano. It encodes the frame opacity condition. ********)

(* MODIFIED TO TEST A STRONG DEF OF UK using UKANO, variant (a) in Section 6.2.2 (i.e., sKI is a private constant)
 * MINIMAL VERSION FOR DAA SIGN
 * Lucca Hirschi
 * 23/03/2016
 *)

(*
	Based on:

		Smyth, B., Ryan, M., & Chen, L. (2012) Formal analysis of anonymity in Direct Anonymous Attestation schemes.

	The script models the fixed RSA-based Direct Anonymous Attestation process specification <Join_RSA', Sign_RSA'>.

*)

(***************)
(* ==THEORY==  *)
(***************)
free c:channel.

fun accept () :bitstring.
fun zero() :bitstring.
fun one() :bitstring.
fun FJoin() :bitstring.
fun FSign() :bitstring.
fun hash(bitstring) :bitstring.
fun pk(bitstring) :bitstring.
fun commit(bitstring,bitstring):bitstring.
fun circ(bitstring,bitstring):bitstring.
fun clcommit(bitstring,bitstring,bitstring) :bitstring.
fun spk(bitstring,bitstring,bitstring) :bitstring.
fun clsign(bitstring,bitstring,bitstring,bitstring):bitstring.
fun getmsgspk(bitstring) :bitstring.

(* Signature + blind signtaure *)
reduc forall xsk:bitstring,xprime:bitstring,xrand:bitstring,xmsg:bitstring;
  clgetprime(clsign(xsk,xprime,xrand,xmsg)) = xprime.
reduc forall xsk:bitstring,xprime:bitstring,xrand:bitstring,xmsg:bitstring;
  clgetbitstring(clsign(xsk,xprime,xrand,xmsg)) = xrand.
reduc forall xsk:bitstring,xprime:bitstring,xrand:bitstring,xmsg:bitstring;
  checkclsign(pk(xsk),xmsg,clsign(xsk,xprime,xrand,xmsg)) 
				= accept.
fun clopen(bitstring,bitstring,bitstring) :bitstring
reduc forall x:bitstring,xrand:bitstring,xplain:bitstring;
  clopen(x,xrand,clcommit(x,xrand,xplain)) = xplain
otherwise forall xsk:bitstring,xrand:bitstring,yprime:bitstring,yrand:bitstring,xmsg:bitstring;
  clopen(pk(xsk),xrand,clsign(xsk,yprime,yrand,
	clcommit(pk(xsk),xrand,xmsg))) = clsign(xsk,yprime,xrand,xmsg).
(* ZK of sign *)
reduc forall xzeta:bitstring,xsk:bitstring,xtsk:bitstring,xw:bitstring,xe:bitstring,xv:bitstring,xrand:bitstring,yprime:bitstring,yrand:bitstring,xmsg:bitstring;
   checkspk(FSign,
            (xzeta,pk(xsk),commit(xtsk,xzeta),
	        clcommit(pk(xsk),xw,clsign(xsk,xe,xv,xtsk)),xmsg),
            spk(FSign,(xtsk,xw),(xzeta,pk(xsk),commit(xtsk,xzeta),
	        clcommit(pk(xsk),xw,clsign(xsk,xe,xv,xtsk)),xmsg)))
   = accept.

fun KI():bitstring.    (* Long-term public bitstring of Issuer *)
(* Below: secret bitstring of the issuer and corresponding public bitstring given to the attacker.
   We model a single issuer but unbounded many clients having credentials from this issuer.
   Anonymity set=those users.
*)
fun skI():bitstring [private].
reduc getPubskI() = pk(skI).

(*
event END().
query event(END()).
*)

(****************)
(*  *)


(* == PROTOCOL WITH IDEALISATION == *)
let SYSTEM =
( !
  new r2 : bitstring;
  new r1 : bitstring;
  new DAASeed : bitstring;
  new cnt : bitstring;
     !
      ((
        new nv_135: bitstring;
        out(c, nv_135);
        in(c, choice[x_136,xid_136]: bitstring);
        let ((xz: bitstring,=pk(skI),xNV: bitstring,xcreH: bitstring,xnt: bitstring,xmsg_137: bitstring,xZK: bitstring)) = x_136 in
        let (=accept) = checkspk(FSign,(xz,pk(skI),xNV,xcreH,(xnt,nv_135,xmsg_137)),xZK) in
        out(c, accept)
      )|(
        in(c, choice[nv,nvid]: bitstring);
        new w: bitstring;
        new zeta: bitstring;
        let (crehat: bitstring) = clcommit(pk(skI),w,clsign(skI,r1,r2,hash((hash((DAASeed,hash(KI))),cnt,zero)))) in
        let (NV: bitstring) = commit(hash((hash((DAASeed,hash(KI))),cnt,zero)),zeta) in
        new msg: bitstring;
        new nt: bitstring;
        new tsk_hole: bitstring;
        new r1_133: bitstring;
        new r2_134: bitstring;
        out(c, choice[(zeta,pk(skI),NV,crehat,nt,msg,spk(FSign,(hash((hash((DAASeed,hash(KI))),cnt,zero)),w),(zeta,pk(skI),NV,crehat,(nt,nv,msg)))),(zeta,pk(skI),commit(tsk_hole,zeta),clcommit(pk(skI),w,clsign(skI,r1_133,r2_134,tsk_hole)),nt,msg,spk(FSign,(tsk_hole,w),(zeta,pk(skI),commit(tsk_hole,zeta),clcommit(pk(skI),w,clsign(skI,r1_133,r2_134,tsk_hole)),(nt,nvid,msg))))])
      ))
)
.
process SYSTEM

(* EXPECTPV
RESULT Diff-equivalence is true.
0.088s (user 0.088s + system 0.000s), max rss 10420K
END *)
