


free c: channel.

type pkey.
type skey.
type seed.

(* deterministic public key encryption *)

fun pk(skey): pkey.
fun encrypt(bitstring, pkey): bitstring.
reduc forall x: bitstring, y: skey; decrypt(encrypt(x,pk(y)), y) = x.

(* The attack disappears with probabilistic public-key encryption:

fun pk(skey): pkey.
fun internal_encrypt(bitstring, pkey, seed): bitstring.
reduc forall x: bitstring, y: skey, r: seed; decrypt(internal_encrypt(x,pk(y),r), y) = x.
letfun encrypt(x: bitstring, y: pkey) = new r: seed; internal_encrypt(x,y,r).

*)

fun hash(bitstring): bitstring.

free w:bitstring [private].
weaksecret w.

process
	new s: skey;
	let pk = pk(s) in
	out(c, pk);
	out(c, encrypt(hash(w), pk))



(* EXPECTPV
RESULT Weak secret w is false.
0.036s (user 0.032s + system 0.004s), max rss 8840K
END *)
