Completing equations...
-- Process 1-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 192 rules (75 with conclusion selected). Queue: 61 rules.
400 rules inserted. Base: 340 rules (84 with conclusion selected). Queue: 54 rules.
600 rules inserted. Base: 439 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 529 rules (94 with conclusion selected). Queue: 60 rules.
1000 rules inserted. Base: 625 rules (94 with conclusion selected). Queue: 71 rules.
1200 rules inserted. Base: 698 rules (94 with conclusion selected). Queue: 68 rules.
1400 rules inserted. Base: 725 rules (95 with conclusion selected). Queue: 45 rules.
1600 rules inserted. Base: 720 rules (111 with conclusion selected). Queue: 14 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_1,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_1 = @occ80[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl)))
goal reachable: b-event(@p_act(@occ80_2,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),WeakHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_2 = @occ80_1[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: b-event(@p_act(@occ80_2,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),StrongHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_2 = @occ80_1[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_2,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_2 = @occ80_1[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_2,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_2 = @occ80_1[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_2,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_2 = @occ80_1[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_2,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_2 = @occ80_1[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) is true.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash))
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_3,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_3 = @occ80_2[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl)))
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_4,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_4 = @occ80_3[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_c,sr_c,WeakHash))
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_5,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_5 = @occ80_4[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(SentBadElement) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 192 rules (75 with conclusion selected). Queue: 61 rules.
400 rules inserted. Base: 340 rules (84 with conclusion selected). Queue: 54 rules.
600 rules inserted. Base: 439 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 529 rules (94 with conclusion selected). Queue: 60 rules.
1000 rules inserted. Base: 625 rules (94 with conclusion selected). Queue: 71 rules.
1200 rules inserted. Base: 698 rules (94 with conclusion selected). Queue: 68 rules.
1400 rules inserted. Base: 725 rules (95 with conclusion selected). Queue: 45 rules.
1600 rules inserted. Base: 720 rules (111 with conclusion selected). Queue: 14 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(SentBadElement)
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_6,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_6 = @occ80_5[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(SentBadElement) is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash))
goal reachable: b-event(@p_act(@occ80_7,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),WeakHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_7 = @occ80_6[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: b-event(@p_act(@occ80_7,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),StrongHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_7 = @occ80_6[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_7,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_7 = @occ80_6[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_7,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_7 = @occ80_6[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_7,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_7 = @occ80_6[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_7,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_7 = @occ80_6[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) is true.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash))
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_8,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_8 = @occ80_7[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash))
goal reachable: b-event(@p_act(@occ80_9,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),WeakHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_9 = @occ80_8[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: b-event(@p_act(@occ80_9,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),StrongHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_9 = @occ80_8[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_9,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_9 = @occ80_8[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_9,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_9 = @occ80_8[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_9,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_9 = @occ80_8[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_9,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_9 = @occ80_8[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) is true.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash))
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_10,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_10 = @occ80_9[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(SentBadElement) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(SentBadElement)
goal reachable: b-event(@p_act(@occ80_11,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),WeakHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_11 = @occ80_10[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: b-event(@p_act(@occ80_11,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),StrongHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_11 = @occ80_10[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_11,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_11 = @occ80_10[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_11,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_11 = @occ80_10[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_11,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_11 = @occ80_10[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_11,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_11 = @occ80_10[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(SentBadElement) is true.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement)
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_12,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
sh: 1: dot: not found
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_12 = @occ80_11[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
Warning: Could not create PDF version of the trace.
Please verify that graphviz is installed in your computer.
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement) is false.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement)
goal reachable: b-event(@p_act(@occ80_13,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),WeakHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_13 = @occ80_12[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: b-event(@p_act(@occ80_13,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),StrongHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_13 = @occ80_12[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_13,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_13 = @occ80_12[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_13,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_13 = @occ80_12[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_13,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_13 = @occ80_12[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_13,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_13 = @occ80_12[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement) is true.
-- Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) || event(SentBadElement) in process 1
Translating the process into Horn clauses...
Completing...
200 rules inserted. Base: 187 rules (75 with conclusion selected). Queue: 69 rules.
400 rules inserted. Base: 379 rules (84 with conclusion selected). Queue: 58 rules.
600 rules inserted. Base: 497 rules (92 with conclusion selected). Queue: 38 rules.
800 rules inserted. Base: 586 rules (94 with conclusion selected). Queue: 52 rules.
1000 rules inserted. Base: 688 rules (94 with conclusion selected). Queue: 64 rules.
1200 rules inserted. Base: 759 rules (94 with conclusion selected). Queue: 70 rules.
1400 rules inserted. Base: 794 rules (94 with conclusion selected). Queue: 52 rules.
1600 rules inserted. Base: 813 rules (106 with conclusion selected). Queue: 17 rules.
Starting query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) || event(SentBadElement)
goal reachable: b-event(@p_act(@occ80_14,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),WeakHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_14 = @occ80_13[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: b-event(@p_act(@occ80_14,SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(StrongDH,dh_ideal(G,x_3)))) && attacker(eee_2) && attacker(ev_type_2) && attacker(eee_3) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(dh_ideal(dh_ideal(G,x_3),x_4))),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_3)),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_4 = privLTK[!1 = @sid_1]
ID_S_5 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
x_4 = x[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(StrongDH,eee_3),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_4),ignored_v_7 = privLTK_4,ignored_v_6 = ID_S_5,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
privEK_3 = privEK[!2 = @sid_7,!1 = @sid_8]
privAK_5 = privAK[!1 = @sid_8]
privLTK_5 = privLTK[!1 = @sid_8]
ID_S_6 = ID_S[!1 = @sid_8]
privEK_6 = privEK[!2 = @sid_9,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_10,!1 = @sid_3]
privEK_8 = privEK[!2 = @sid_11,!1 = @sid_3]
x_3 = x_2[smode = nego(aTLS,DHE_13(StrongDH,eee_2),StrongHash,ev_type_2),ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(StrongDH,dh_ideal(G,x_4)),hash_algo_2,ev_type_3),ar_2),!2 = @sid_12,server_cert_2 = ((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))),ignored_v_33 = pk(privLTK_3),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_5),ignored_v_29 = privLTK_5,ignored_v_28 = ID_S_6,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_4),ignored_v_24 = privLTK_4,ignored_v_23 = ID_S_5,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_4),ignored_v_19 = privAK_4,pubLTK_2 = pk(privLTK_3),privLTK_1 = privLTK_3,ignored_v_18 = ID_S_4,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_4),ignored_v_14 = privAK_4,ignored_v_13 = pk(privLTK_3),ignored_v_12 = privLTK_3,ID_S_2 = ID_S_4,!1 = @sid_13]
@occ80_14 = @occ80_13[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_14,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_14 = @occ80_13[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_14,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),WeakHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,collision),sign(privLTK_3,collision))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_14 = @occ80_13[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_14,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,WeakHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),WeakHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,collision),sign(privLTK_5,collision))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_14 = @occ80_13[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
goal reachable: attacker(k) && attacker(selfsign_2) && attacker(sr_c) && attacker(e) && attacker(sev_type_1) && b-event(@p_act(@occ80_14,SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))) && b-event(ServerChoosesHash(cr_2,sr_2,StrongHash)) && b-event(ServerChoosesKEX(cr_2,sr_2,DHE_13(WeakDH,BadElement))) && attacker(ev_type_2) && attacker(eee_2) && attacker(hash_algo_2) && attacker(ev_type_3) -> event(ClientStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))),CV_Ext(sign(k,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))),sign(privLTK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_c,nego(aTLS,DHE_13(WeakDH,e),StrongHash,sev_type_1))),CRT(pk(k),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),selfsign_2,ID_S_4,((ID_S_4,pk(privLTK_3)),sign(privCA[],(ID_S_4,pk(privLTK_3)))))))))))))))),(tls13_key,zero))),cr_2,sr_c)) && event(ServerStateEvCV2(((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),b2ae(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_derived,hash_ideal(zero))),zero),(tls13_client_application_traffic_secret,hash_ideal(((((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))),FIN(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_derived,hash_ideal(zero))),e2b(BadElement)),(tls13_server_handshake_traffic_secret,hash_ideal((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2)))))),(tls13_finished,zero)),(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))),CV_Ext(sign(privEK_3,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))),sign(privLTK_5,hash_ideal(((CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),SH(sr_2,nego(aTLS,DHE_13(WeakDH,BadElement),StrongHash,ev_type_2))),CRT(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))),sign(privEK_3,(pk(privEK_3),((hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]),sign(privAK_3,(hmac_ideal(hmac_ideal(hmac_ideal(hmac_ideal(zero,zero),(tls13_early_exporter_master_secret,hash_ideal(CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2)))),(user_defined,hash_ideal(zero))),(tls13_exporter,hash_ideal(context_value))),dev_statusRef[]))))),ID_S_5,((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))))))))))))))),(tls13_key,zero))),cr_2,sr_2))
Abbreviations:
privEK_4 = privEK[!2 = @sid,!1 = @sid_1]
privAK_3 = privAK[!1 = @sid_1]
privLTK_6 = privLTK[!1 = @sid_1]
ID_S_6 = ID_S[!1 = @sid_1]
privEK_5 = privEK[!2 = @sid_2,!1 = @sid_3]
privAK_4 = privAK[!1 = @sid_3]
privLTK_3 = privLTK[!1 = @sid_3]
ID_S_4 = ID_S[!1 = @sid_3]
cr_2 = cr[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ar_2 = ar[ioffer = nego(aTLS,DHE_13(WeakDH,eee_2),hash_algo_2,ev_type_3),!3 = @sid_4,ignored_v_11 = pk(privEK_4),ignored_v_10 = privEK_4,pubAK_1 = pk(privAK_3),ignored_v_9 = privAK_3,ignored_v_8 = pk(privLTK_6),ignored_v_7 = privLTK_6,ignored_v_6 = ID_S_6,ignored_v_5 = pk(privEK_5),ignored_v_4 = privEK_5,ignored_v_3 = pk(privAK_4),ignored_v_2 = privAK_4,ignored_v_1 = pk(privLTK_3),ignored_v = privLTK_3,ID_S_1 = ID_S_4,!2 = @sid_5,!1 = @sid_6]
ID_S_5 = ID_S[!1 = @sid_7]
privLTK_4 = privLTK[!1 = @sid_7]
privEK_3 = privEK[!2 = @sid_8,!1 = @sid_9]
privAK_5 = privAK[!1 = @sid_9]
privLTK_7 = privLTK[!1 = @sid_9]
ID_S_7 = ID_S[!1 = @sid_9]
privEK_6 = privEK[!2 = @sid_10,!1 = @sid_1]
privEK_7 = privEK[!2 = @sid_11,!1 = @sid_12]
privAK_6 = privAK[!1 = @sid_12]
privLTK_5 = privLTK[!1 = @sid_12]
ID_S_8 = ID_S[!1 = @sid_12]
privEK_8 = privEK[!2 = @sid_13,!1 = @sid_7]
privAK_7 = privAK[!1 = @sid_7]
sr_2 = sr_1[ch_1 = CH(cr_2,nego(aTLS,DHE_13(WeakDH,BadElement),hash_algo_2,ev_type_3),ar_2),!2 = @sid_14,server_cert_2 = ((ID_S_5,pk(privLTK_4)),sign(privCA[],(ID_S_5,pk(privLTK_4)))),ignored_v_33 = pk(privLTK_4),pubEK_2 = pk(privEK_3),privEK_1 = privEK_3,ignored_v_32 = pk(privAK_5),ignored_v_31 = privAK_5,ignored_v_30 = pk(privLTK_7),ignored_v_29 = privLTK_7,ignored_v_28 = ID_S_7,ignored_v_27 = pk(privEK_6),ignored_v_26 = privEK_6,pubAK_2 = pk(privAK_3),privAK_1 = privAK_3,ignored_v_25 = pk(privLTK_6),ignored_v_24 = privLTK_6,ignored_v_23 = ID_S_6,ignored_v_22 = pk(privEK_7),ignored_v_21 = privEK_7,ignored_v_20 = pk(privAK_6),ignored_v_19 = privAK_6,pubLTK_2 = pk(privLTK_5),privLTK_1 = privLTK_5,ignored_v_18 = ID_S_8,ignored_v_17 = pk(privEK_8),ignored_v_16 = privEK_8,ignored_v_15 = pk(privAK_7),ignored_v_14 = privAK_7,ignored_v_13 = pk(privLTK_4),ignored_v_12 = privLTK_4,ID_S_2 = ID_S_5,!1 = @sid_15]
@occ80_14 = @occ80_13[!3 = @sid_4,!2 = @sid_5,!1 = @sid_6]
RESULT event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) || event(SentBadElement) is true.

--------------------------------------------------------------
Verification summary:

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) is true.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(SentBadElement) is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) is true.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) is true.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(SentBadElement) is true.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement) is false.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(SentBadElement) is true.

Query event(ClientStateEvCV2(ev,kc1,cr_c,sr_c)) && event(ServerStateEvCV2(ev,kc2,cr_s,sr_s)) ==> kc1 = kc2 || event(ServerChoosesKEX(cr_s,sr_s,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_s,sr_s,WeakHash)) || event(ServerChoosesKEX(cr_c,sr_c,DHE_13(WeakDH,badEl))) || event(ServerChoosesHash(cr_c,sr_c,WeakHash)) || event(SentBadElement) is true.

--------------------------------------------------------------