free c.
(* 

A -> B : A, N_A
B -> S : B, N_B, { A, N_A }_Kbs
S -> A : N_B, { B, K_ab, N_A }_Kas, { A, K_ab, N_B }_Kbs
A -> B : { A, K_ab, N_B }_Kbs, { N_B }_Kab

Full agreement wrong (l'attaquant peut s'arranger pour que A ne voie pas
{ A, K_ab, N_B }_Kbs).

No agreement on N_A, but agreement on N_B and on the session key K_ab.

Attack of Syverson for Aparam

*)

fun host/1.
private reduc getkey(host(x)) = x.

(* Shared key cryptography *)

fun encrypt/2.
reduc decrypt(encrypt(x,y),y) = x.

authquery Aparam/1.
authquery Bparam/1.
authquery Bkey/4.

let processA = new Na; out(c, (host(kas), Na)); in(c, m);
	       let (nb, m1, m2) = m in
               let (b, kab, na2) = decrypt(m1, kas) in
	       begin Bparam(b);
	       begin Bkey(b, host(kas), nb, kab);
               if na2 = Na then 
                 out(c, (m2, encrypt(nb, kab)));
		 (* OK *)
		 if b = host(kbs) then 
		    end Aparam(host(kas)).
                         
let processB = in(c, m); 
               let (a, na) = m in
	       begin Aparam(a);
               new Nb; out(c, (host(kbs), Nb, encrypt(m, kbs)));
	       in(c, m2);
               let (m3, m4) = m2 in
               let (a2, kab, nb2) = decrypt(m3, kbs) in
               let nb3 = decrypt(m4, kab) in
               if a2 = a then
                 if nb2 = Nb then
                   if nb3 = Nb then
		     (* OK *)
                     if a = host(kas) then 
			end Bparam(host(kbs));
		        end Bkey(host(kbs), a, Nb, kab). 

let processBasA = new Na; out(c, (host(kbs), Na)); in(c, m);
	       let (nb, m1, m2) = m in
               let (b, kab, na2) = decrypt(m1, kbs) in
               if na2 = Na then 
                 out(c, (m2, encrypt(nb, kab)))
	       else 0.
                         
let processAasB = in(c, m); 
               let (a, na) = m in
               new Nb; out(c, (host(kas), Nb, encrypt(m, kas)));
	       in(c, m2);
               let (m3, m4) = m2 in
               let (a2, kab, nb2) = decrypt(m3, kas) in
               let nb3 = decrypt(m4, kab) in
               if a2 = a then
                 if nb2 = Nb then
                   if nb3 = Nb then
                     0 (* OK *)
                   else 0
                 else 0
               else 0.

let processS = in(c, m); let (b, nb, m5) = m in
			 let kbs2 = getkey(b) in
                         let (a, na) = decrypt(m5,kbs2) in
                         let kas2 = getkey(a) in
                         new kab;
			 out(c, (nb, encrypt((b, kab, na), kas2), encrypt((a, kab, nb), kbs2))).


process new kas; new kbs; 
	((!processA) | (!processB) | (!processBasA) | (!processAasB) | (!processS))
