pred c/1 elimVar,decompData.
nounif c:x.

fun pk/1.
fun encrypt/2.

fun sign/2.

query c:secret[].

reduc
(* Initialization *)

c:c[];
c:pk(sA[]);
c:pk(sB[]);

(* The attacker *)

c:x & c:encrypt(m,pk(x)) -> c:m;
c:x -> c:pk(x);
c:x & c:y -> c:encrypt(x,y);
c:sign(x,y) -> c:x;
c:x & c:y -> c:sign(x,y);

(* The protocol *)
(* A *)

c:pk(x) -> c:encrypt(sign(k[pk(x)], sA[]), pk(x));

(* B *)

c:encrypt(sign(k, sA[]), pk(sB[])) -> c:encrypt(secret[], pk(k)).

(* EXPECTPV
RESULT goal reachable: c:secret[]
0.004s (user 0.004s + system 0.000s), max rss 7196K
END *)
