free c : channel.
(* 

A -> B : A, N_A
B -> S : B, N_B, { A, N_A }_Kbs
S -> A : N_B, { B, K_ab, N_A }_Kas, { A, K_ab, N_B }_Kbs
A -> B : { A, K_ab, N_B }_Kbs, { N_B }_Kab

Full agreement is wrong (the adversary can arrange so that A does not see
{ A, K_ab, N_B }_Kbs).

No agreement on N_A, but agreement on N_B and on the session key K_ab.

Attack of Syverson for evinj:endAparam(x) ==> evinj:beginAparam(x).
*)

type key.
type host.
type nonce.

fun nonce_to_bitstring(nonce):bitstring [data,typeConverter].

(* Shared key cryptography *)

fun encrypt(bitstring,key):bitstring.
reduc forall x:bitstring, y:key; decrypt(encrypt(x,y),y) = x.

(* 2 honest host names A and B *)

free A, B: host.



free secretA: bitstring [private].
query attacker(secretA).


(* Role of the initiator with identity xA and key kas shared with S *)

type seed.
type pkey.
type skey.
fun pkgen(seed): pkey.
fun skgen(seed): skey.

letfun kgen(r: seed) = (pkgen(r), skgen(r)).

(* Start process *)

process
	in(c, t:bool);
	let x = (if t then A) in
	out(c, (x, kgen(new r: seed; r)))

(* EXPECTPV
RESULT not attacker(secretA[]) is true.
0.008s (user 0.004s + system 0.004s), max rss 7476K
END *)
