
(* Following queries fail for TLS 1.2 but should succeed for TLS 1.3 *)
query cr:random, sr:random, p:pubkey, cr':random, sr':random, p':pubkey;
      event(MatchingResumptionSecret(TLS12,cr,sr,p,TLS12,cr',sr',p')).

query cr:random, sr:random, p:pubkey, cr':random, sr':random, p':pubkey;
      event(MatchingAEKey(TLS12,cr,sr,p,TLS12,cr',sr',p')).

(* Following secrecy queries should fail *)

query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version;
      event(ClientAEKeyLeaked(TLS12,cr,sr,psk,p)) ==>
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||     
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))).


query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version;
      event(ClientAEKeyLeaked(TLS12,cr,sr,psk,p)) ==>
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||     
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 


query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version;
      event(ClientAEKeyLeaked(TLS12,cr,sr,psk,p)) ==>
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption)))  ||  
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 


query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, cb:bitstring, cr':random, sr':random, v:version;
      event(ClientAEKeyLeaked(TLS12,cr,sr,psk,p)) ==>
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||     
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption)))  ||  
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 

(* Following authentication queries should fail *)

query cr:random, sr:random, cr':random, sr':random,
      psk:preSharedKey,p:pubkey, 
      o:params, m:params,  
      ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
      event(ClientFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ==>
      event(ServerFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ||
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||    
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))).

query cr:random, sr:random, cr':random, sr':random,
      psk:preSharedKey,p:pubkey, 
      o:params, m:params,  
      ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
      event(ClientFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ==>
      event(ServerFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ||
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||    
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 

query cr:random, sr:random, cr':random, sr':random,
      psk:preSharedKey,p:pubkey, 
      o:params, m:params,  
      ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
      event(ClientFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ==>
      event(ServerFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ||
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))) || 
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 

query cr:random, sr:random, cr':random, sr':random,
      psk:preSharedKey,p:pubkey, 
      o:params, m:params,  
      ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
      event(ClientFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ==>
      event(ServerFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ||
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||    
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))) || 
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 


(* Main channel-binding query: fails if cb = ms, succeeds if cb = m1 *)
query cr:random, sr:random, p:pubkey, cr':random, sr':random, p':pubkey;
      event(MatchingChannelBinding(TLS12,cr,sr,p,TLS12,cr',sr',p')).


(* Main handshake authentication query: every disjunct is required; commenting any of them results in "false" *)

query cr:random, sr:random, cr':random, sr':random,
      psk:preSharedKey,p:pubkey, 
      o:params, m:params,  
      ck:ae_key,sk:ae_key,ms:bitstring,cb:bitstring;
      inj-event(ClientFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ==>
      inj-event(ServerFinished(TLS12,cr,sr,NoPSK,p,o,m,ck,sk,cb,ms)) ||
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||    
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))) || 
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 

(* Main handshake secrecy query: every disjunct is required *)

query cr:random, sr:random, psk:preSharedKey, p:pubkey, ms:bitstring, aek:ae_key, 
      ra:rsa_alg, cb:bitstring, cr':random, sr':random, v:version;
      event(ClientAEKeyLeaked(TLS12,cr,sr,psk,p)) ==>
      event(WeakOrCompromisedKey(p)) ||  
      (event(PostSessionCompromisedKey(p)) &&
       event(ServerChoosesKEX(cr,sr,p,TLS12,RSA(ra))))  ||   
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||     
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption)))  ||  
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 


(* Main appData authentication query: every disjunct is required; commenting any of them results in "false" *)
(* Replay prevention relies on the recipient not accepting 2 messages with the same (n,ad);
   it is not explicitly proved in ProVerif. *)

query cr:random, sr:random, cr':random, sr':random,
      psk:preSharedKey,p:pubkey, n:bitstring, ad:bitstring, m:bitstring;
      event(ClientReceives(TLS12,cr,sr,NoPSK,p,n,ad,m)) ==>
      event(ServerSends(TLS12,cr,sr,NoPSK,p,n,ad,m)) ||
      event(WeakOrCompromisedKey(p)) ||  
      event(ServerChoosesAE(cr,sr,p,TLS12,WeakAE)) ||    
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||    
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption))) || 
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 

(* Main appData secrecy query: every disjunct is required *)

query cr:random, sr:random, psk:preSharedKey, 
      p:pubkey, ms:bitstring, aek:ae_key, 
      g:group, ra:rsa_alg, 
      cb:bitstring, cr':random, sr':random, v:version;
      attacker(m_c(TLS12,cr,sr,p,psk)) ==>
      event(WeakOrCompromisedKey(p)) ||  
      (event(PostSessionCompromisedKey(p)) &&
       event(ServerChoosesKEX(cr,sr,p,TLS12,RSA(ra))))  ||   
      event(ServerChoosesAE(cr,sr,p,TLS12,WeakAE)) ||     
      event(ServerChoosesKEX(cr,sr,p,TLS12,DHE(WeakDH))) ||     
      event(ServerChoosesKEX(cr',sr',p,TLS12,RSA(WeakRSADecryption)))  ||  
      event(ServerChoosesHash(cr',sr',p,TLS12,WeakHash)). 

        
process 
	!Client12() | !Server12() | 
	!longTermKeys() | !appData() |
	!secrecyQuery() | !channelBindingQuery()
