Def(B) = nb := n(BNAME,r), kbs := mkey(BNAME, s) .
Def(S) = kas := mkey(ANAME,s), kbs := mkey(BNAME,s) .
1 . A -> B : A |- A .
1 . A -> B : ANAME |- ANAME .
//This is very very prone to typos. We need to come up with a better naming convention for macros. I'm thinking all lower-case. It might clash a little bit with
//constants, but constants are rarely used in the protocol declaration.
types Uname Sname name Key Nonce Masterkey Sessionkey .
types Uname Sname Name Key Nonce Masterkey Sessionkey .
subtype Masterkey Sessionkey < Key .
subtype Sname Uname < name .
subtype name < Public .
subtype Sname Uname < Name .
subtype Name < Public .
op n : name Fresh -> Nonce .
op n : Name Fresh -> Nonce .
ops a b i : -> Uname [ctor] .
op s : -> Sname [ctor] .
op mkey : name name -> Masterkey .
op seskey : name name Nonce -> Sessionkey .
op mkey : Name Name -> Masterkey .
op seskey : Name Name Nonce -> Sessionkey .
op e : Key Msg -> Msg .
op d : Key Msg -> Msg .
op _;_ : Msg Msg -> Msg [gather (e E)] .
...
...
@@ -25,74 +25,68 @@ Theory
A -> B : E(kbs:A,kab),E(kab:nb)
*/
/*
Note: The variable scoping here makes no sense. Ostensibly, the SK in Protocol, and the SK in Attacks should be different values. However, they're meant to represent the same
value. So, it seems like we should allow global variable declarations. Of course, the way the code is currently structured, implementing that won't exactly be trivial.
*/
Protocol
vars A B : Uname .
var S : Sname .
vars NA NB : Nonce .
vars ANAME BNAME : Uname .
var SNAME : Sname .
vars NA NBA NAS NBS : Nonce .
var r : Fresh .
var M N MB : Msg .
var SK : Sessionkey .
var D : name .
var SKA SKB : Sessionkey .
var D : Name .
var K : Key .
Def(A) = na := n(A, r), kas := mkey(A,s) .
In(A) = A, B, S .
roles A B S .
In(A) = ANAME, BNAME, SNAME .
In(B) = ANAME, BNAME, SNAME .
In(S) = ANAME, BNAME, SNAME .
Def(A) = na := n(ANAME, r), kas := mkey(ANAME,s) .
Def(B) = nb := n(B, r), kbs := mkey(B,s) .
In(B) = A, B, S .
Def(B) = nb := n(BNAME, r), kbs := mkey(BNAME,s) .
Def(S) = kas := mkey(A, s), kbs := mkey(B, s), kab := seskey(A , B , n(s,r)) .
In(S) = A, B, S .
Def(S) = kas := mkey(ANAME, s), kbs := mkey(BNAME, s),
kab := seskey(ANAME , BNAME , n(s,r)) .
1 . A -> B : A ; na
|- A ; NA .
1 . A -> B : ANAME ; na
|- ANAME ; NA .
2 . B -> S : B ; e(kbs, A ; NA ; nb)
|- B ; e(kbs, A ; NA ; NB) .
2 . B -> S : BNAME ; e(kbs, ANAME ; NA ; nb)
|- BNAME ; e(kbs, ANAME ; NAS ; NBS) .
3 . S -> A : e(kas, B ; kab ; NA ; NB) ; e(kbs, A ; kab)
|- e(kas, B ; SK ; na ; NB) ; MB .
3 . S -> A : e(kas, BNAME ; kab ; NAS ; NBS) ; e(kbs, ANAME ; kab)