(* This file was automatically generated from daa-verify-tpmcontrolled-rogue3.pvz. *)
(*** META: expect: ^RESULT ev:DAAVERIFIEDP.* ==> ev:DAASIGNEDP.* is true\.$ ***)
(*** META: expect: ^RESULT ev:DAAVERIFIEDA.* ==> \(?ev:DAASIGNEDA.* is true\.$ ***)
fun blindsign/2.
fun roguetest/5.
free rogueid1.
free rogueid2.
free rogueid3.
fun fst/1.
fun false/0.
fun beta4/0. (* autogenerated ZK-theory *)
fun fakezk1/3. (* autogenerated ZK-theory *)
fun sigver/3.
fun sk/1.
fun fakezk0/2. (* autogenerated ZK-theory *)
free id2.
fun beta1/0. (* autogenerated ZK-theory *)
fun fakezk4/6. (* autogenerated ZK-theory *)
fun hash/1.
free id1.
fun beta2/0. (* autogenerated ZK-theory *)
fun fakezk3/5. (* autogenerated ZK-theory *)
fun blindmessage/1.
fun or/2.
fun beta3/0. (* autogenerated ZK-theory *)
fun fakezk2/4. (* autogenerated ZK-theory *)
free id3.
free pub.
private free int1.
private free int2.
fun sign/2.
fun exp/2.
fun fakever/3. (* autogenerated ZK-theory *)
fun pk/1.
free n1.
free n0.
fun pair/2.
fun fakepublic/2. (* autogenerated ZK-theory *)
free n2.
private fun pzk1/7. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
fun land/2.
fun public2/1. (* autogenerated ZK-theory *)
fun public1/1. (* autogenerated ZK-theory *)
fun public4/1. (* autogenerated ZK-theory *)
fun public3/1. (* autogenerated ZK-theory *)
fun alpha2/0. (* autogenerated ZK-theory *)
fun dec/2.
fun alpha1/0. (* autogenerated ZK-theory *)
fun zkver0/1. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
private fun pzk0/7. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
fun zkver1/1. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
fun zk0/6. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
fun snd/1.
fun enc/2.
fun zk1/6. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
fun g/2. (* autogenerated ZK-theory *)
fun d/2.
fun e/2.
fun blindver/3.
private fun daaseed/1.
free bsnI.
fun true/0.
private fun issuerK/0.
fun message/1.
private fun ek/1.
fun unblind/2.
free bsnV.
fun blind/2.
fun formula/1. (* autogenerated ZK-theory *)
fun eq/2.
query ev:DAAVERIFIEDP(xm,xbsn,xN) ==> ev:DAASIGNEDP(xid,xcnt,xbsn,xm).
query ev:DAAVERIFIEDA(xm) ==> (ev:DAASIGNEDA(xid,xcnt,xm) | ev:DAASIGNEDP(xid,xcnt,xbsn,xm)).
(* Registering 2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3)) as 0 *)
(* Registering 2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1))) as 1 *)
(* Using max public arity l <= 4 *)
(* Using max private arity h <= 2 *)
reduc equals(x,x)=x.
equation roguetest(zeta,exp(zeta,x),x,y,z) = true.
equation roguetest(zeta,exp(zeta,y),x,y,z) = true.
equation roguetest(zeta,exp(zeta,z),x,y,z) = true.
equation eq(x,x) = true.
equation or(x,true) = true.
equation or(true,x) = true.
equation land(true,true) = true.
equation fst(pair(x,y)) = x.
equation snd(pair(x,y)) = y.
equation d(e(x,y),y) = x.
equation dec(enc(x,pk(y)),sk(y)) = x.
equation message(sign(x,y)) = x.
equation sigver(sign(x,sk(y)),x,pk(y)) = true.
equation blindver(unblind(blindsign(blind(x,z),sk(y)),z),x,pk(y)) = true.
equation blindmessage(unblind(blindsign(blind(x,z),y),z)) = x.
equation zk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5) = pzk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,land(eq(xbeta1x2,exp(xbeta2x3,xalpha1x0)),blindver(xalpha2x1,xalpha1x0,xbeta3x4))). (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
equation zkver0(pzk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,true)) = true. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
equation public1(pzk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x6)) = xbeta1x2. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
equation public2(pzk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x6)) = xbeta2x3. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
equation public3(pzk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x6)) = xbeta3x4. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
equation public4(pzk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x6)) = xbeta4x5. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
equation formula(pzk0(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x6)) = land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3)). (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3))) *)
equation zk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5) = pzk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,land(eq(xbeta1x2,blind(xalpha1x0,xalpha2x1)),eq(xbeta2x3,exp(xbeta3x4,xalpha1x0)))). (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
equation zkver1(pzk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,true)) = true. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
equation public1(pzk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x7)) = xbeta1x2. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
equation public2(pzk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x7)) = xbeta2x3. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
equation public3(pzk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x7)) = xbeta3x4. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
equation public4(pzk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x7)) = xbeta4x5. (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
equation formula(pzk1(xalpha1x0,xalpha2x1,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,x7)) = land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1))). (* autogenerated ZK-theory for ZK(2;4;land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) *)
equation public1(fakezk2(x8,xbeta1x2,xbeta2x3,y9)) = xbeta1x2. (* autogenerated ZK-theory *)
equation public1(fakezk3(x8,xbeta1x2,xbeta2x3,xbeta3x4,y9)) = xbeta1x2. (* autogenerated ZK-theory *)
equation public2(fakezk3(x8,xbeta1x2,xbeta2x3,xbeta3x4,y9)) = xbeta2x3. (* autogenerated ZK-theory *)
equation public1(fakezk4(x8,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,y9)) = xbeta1x2. (* autogenerated ZK-theory *)
equation public2(fakezk4(x8,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,y9)) = xbeta2x3. (* autogenerated ZK-theory *)
equation public3(fakezk4(x8,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,y9)) = xbeta3x4. (* autogenerated ZK-theory *)
equation formula(fakezk0(x8,y9)) = y9. (* autogenerated ZK-theory *)
equation formula(fakezk1(x8,xbeta1x2,y9)) = y9. (* autogenerated ZK-theory *)
equation formula(fakezk2(x8,xbeta1x2,xbeta2x3,y9)) = y9. (* autogenerated ZK-theory *)
equation formula(fakezk3(x8,xbeta1x2,xbeta2x3,xbeta3x4,y9)) = y9. (* autogenerated ZK-theory *)
equation formula(fakezk4(x8,xbeta1x2,xbeta2x3,xbeta3x4,xbeta4x5,y9)) = y9. (* autogenerated ZK-theory *)
let leakpublic = ((out(pub,pk(issuerK))) | (! in(pub,id); out(pub,pk(ek(id))))).
let tpmcontrolledall = ! in(pub,id); tpmcontrolled.
let daavera = in(comm,zkproof); (let xif12 = equals(zkver0(zkproof),true) in (let N = public1(zkproof) in (let zeta = public2(zkproof) in (let xif11 = equals(public3(zkproof),pk(issuerK)) in (let m = public4(zkproof) in (let xif10 = equals(roguetest(zeta,N,hash(pair(daaseed(rogueid1),n1)),hash(pair(daaseed(rogueid2),n1)),hash(pair(daaseed(rogueid2),n2))),true) in event ROGUEAV(m) else event DAAVERIFIEDA(m))))))).
let rogueissuer = ! in(pub,v); out(pub,unblind(blindsign(blind(f,v),sk(issuerK)),v)).
let leakissuer = ((! in(pub,id); out(pub,pk(ek(id)))) | (((out(pub,pk(issuerK))) | (out(pub,sk(issuerK)))))).
let tpmcontrolled = (let (comm,comm2) = (pub,pub) in ! in(pub,cnt); new och; ((tpmjoin) | (in(och,cert); ! in(pub,m); ((daasigna) | (in(pub,bsnV); daasignp))))).
let daaverifier = ((! daavera) | (! daaverp)).
let daasigna = new zeta; (let f = hash(pair(daaseed(id),cnt)) in (let N = exp(zeta,f) in (let zkproof = zk0(f,cert,N,zeta,pk(issuerK),m) in event DAASIGNEDA(id,cnt,m); out(comm,zkproof)))).
let issuer = in(comm,zkp); (let xif17 = equals(zkver1(zkp),true) in (let id = public4(zkp) in new nonce; out(comm2,enc(nonce,pk(ek(id)))); in(comm,hashednonce); (let U = public1(zkp) in (let xif16 = equals(hashednonce,hash((U,nonce))) in (let N = public2(zkp) in (let zeta = public3(zkp) in (let xif15 = equals(roguetest(zeta,N,hash(pair(daaseed(rogueid1),n1)),hash(pair(daaseed(rogueid2),n1)),hash(pair(daaseed(rogueid2),n2))),true) in event ROGUEI(id) else (let xif14 = equals(or(or(eq(id,rogueid1),eq(id,rogueid2)),eq(id,rogueid3)),true) in event ROGUEID(id) else (let xif13 = equals(zeta,hash(pair(n1,bsnI))) in (let cert = blindsign(U,sk(issuerK)) in event CERTIFIED(id,N); out(comm,cert))))))))))).
let tpmjoin = (let f = hash(pair(daaseed(id),cnt)) in new v; (let U = blind(f,v) in (let zetaI = hash(pair(n1,bsnI)) in (let NI = exp(zetaI,f) in (let zkp = zk1(f,v,U,NI,zetaI,id) in out(comm,zkp); in(comm2,encnonce); event DEBUG(); (let nonce = dec(encnonce,sk(ek(id))) in out(comm,hash((U,nonce))); in(comm,A); (let cert = unblind(A,v) in (let xif18 = equals(blindver(cert,f,pk(issuerK)),true) in event JOINED(id,cnt,cert); out(och,cert))))))))).
let leaktpm = ((out(pub,daaseed(id))) | (((out(pub,sk(ek(id)))) | (out(pub,pk(ek(id))))))).
let daasignp = (let zeta = hash(pair(n0,bsnV)) in (let f = hash(pair(daaseed(id),cnt)) in (let N = exp(zeta,f) in (let zkproof = zk0(f,cert,N,zeta,pk(issuerK),m) in event DAASIGNEDP(id,cnt,bsnV,m); out(comm,zkproof))))).
let daaverp = in(comm,zkproof); (let xif22 = equals(zkver0(zkproof),true) in (let N = public1(zkproof) in (let zeta = public2(zkproof) in (let xif21 = equals(zeta,hash(pair(n0,bsnV))) in (let xif20 = equals(public3(zkproof),pk(issuerK)) in (let m = public4(zkproof) in (let xif19 = equals(roguetest(zeta,N,hash(pair(daaseed(rogueid1),n1)),hash(pair(daaseed(rogueid2),n1)),hash(pair(daaseed(rogueid2),n2))),true) in event ROGUEPV(m,bsnV,N) else event DAAVERIFIEDP(m,bsnV,N)))))))).
let sanityProcess = (if (land(eq(beta1,exp(beta2,alpha1)),blindver(alpha2,alpha1,beta3)))=(land(eq(beta1,blind(alpha1,alpha2)),eq(beta2,exp(beta3,alpha1)))) then event SANITYFAILED()).
process (((let id = rogueid1 in leaktpm)) | ((((let id = rogueid2 in leaktpm)) | ((((let id = rogueid3 in leaktpm)) | ((((let f = hash(pair(daaseed(rogueid1),n1)) in rogueissuer)) | ((((let f = hash(pair(daaseed(rogueid2),n1)) in rogueissuer)) | ((((let f = hash(pair(daaseed(rogueid2),n2)) in rogueissuer)) | (((leakpublic) | (((tpmcontrolledall) | ((((let comm = pub in issuer)) | ((let comm = pub in daaverifier)))))))))))))))))))

(* EXPECTPV
RESULT ev:DAAVERIFIEDP(xm,xbsn,xN) ==> ev:DAASIGNEDP(xid,xcnt,xbsn,xm) is true.
RESULT ev:DAAVERIFIEDA(xm) ==> ev:DAASIGNEDA(xid,xcnt,xm) | ev:DAASIGNEDP(xid,xcnt,xbsn,xm) is true.
0.616s (user 0.552s + system 0.064s), max rss 12360K
END *)
