free c:channel.

fun enc(bitstring,bitstring):bitstring.
reduc forall x:bitstring, y:bitstring; dec(enc(x,y),y) = x.

fun h(bitstring):bitstring.

event A(bitstring).

free a:bitstring.

query attacker(new k1[z' = a]).
query attacker(new k2[z' = a]).

let P1 =
  in(c,x:bitstring);

  let (x1:bitstring,x2:bitstring) = x in
  let z = dec(x1,x2) in
  let z' = h(x1) in
  new k1:bitstring;
  event A(x);
  (
    out(c,(z,k1)) | out(c,(z',k1))
  ).

let P2 =
  in(c,x:bitstring);

  let (x1:bitstring,x2:bitstring) = x in
  let z = dec(x1,x2) in
  let z' = h(x1) in
  new k2:bitstring;
  event A(x);
  (
    out(c,(k2,z')) | out(c,(k2,z'))
  ).

let P3 =
  in(c,x:bitstring);

  let (x1:bitstring,x2:bitstring) = x in
  let z = dec(x1,x2) in
  let z3' = h(x1) in
  new k3:bitstring;
  if x = a
  then
    event A(h(z3'));
    event A(k3)
  else event A(x).

let P4 =
  in(c,x:bitstring);

  let (x1:bitstring,x2:bitstring) = x in
  let z = dec(x1,x2) in
  let z4' = h(x1) in
  new k4:bitstring;
  if x = a
  then
    event A(h(z4'));
    event A(k4)
  else out(c,h(z4')).

process
  P1 | P2 | P3 | P4

(* EXPECTPV
RESULT not attacker(k1[z' = a[],x = v]) is true.
RESULT not attacker(k2[z'_1 = a[],x_1 = v]) is true.
0.012s (user 0.012s + system 0.000s), max rss 8488K
END *)
